Red Hat and IBM Launch asago Open-Source AI Governance Project and Expand Free Lightwell Access for Universities

• Reading uploaded AI governance policy documents
• Mapping policy clauses to recognised risk frameworks (e.g., NIST AI RMF, OWASP LLM Top 10, EU AI Act) via the IBM AI Risk Atlas
• Generating safety tests linked to identified risks
• Recommending mitigations
• Converting those recommendations into deployment-ready configurations for tools such as Kubernetes, Terraform, and Ansible

Each step produces a documented audit trail that links a policy clause to a specific test or runtime control, allowing reviewers to trace a live safeguard back to the rule that justified it . Red Hat stated the project aims to cut deployment cycles from months to days .

Standards Alignment

The project explicitly maps to NIST AI RMF (Risk Management Framework), OWASP LLM Top 10, and the EU AI Act .

Founding Partners

The founding coalition includes :

• Red Hat (lead)
• IBM Research
• Microsoft
• NVIDIA
• MIT Lincoln Laboratory
• North Carolina State University
• The Alan Turing Institute
• Alquimia AI
• Brave Software
• EvalEval coalition
• Interdisciplinary Transformation University Austria

Additional organisations are expected to join as the project matures.

Licensing

asago is being established under the Apache 2.0 open-source license . The project code is available on GitHub in its formation phase for developers, academic researchers, and enterprise early adopters to review .

Free Lightwell Access for Universities and NGOs

What Was Announced

On 4 August 2026, IBM and Red Hat announced that eligible universities, NGOs, and think tanks would receive free access to Lightwell, an AI-powered platform that finds, validates, and repairs vulnerabilities in open-source software packages . Onboarding for eligible institutions began immediately in August 2026 .

How It Works

• Lightwell uses a generative AI-powered remediation engine alongside IBM and Red Hat engineers .
• The system identifies vulnerable dependencies, develops proposed fixes, and subjects them to technical validation .
• Participating institutions retain control of their confidential information — Lightwell operates within the organisation's existing environment and does not require access to proprietary source code, research, or private data .
• The programme follows an "upstream-always" approach: corrections are submitted to the original open-source communities for review, so improvements benefit users beyond the participating institutions .

What Participants Receive

• Validated fixes for vulnerable open-source software
• Digitally signed source code and software binaries
• Software Bills of Materials (SBOMs)
• Compliance documentation
• Fixes designed for software versions already operating in production (important for institutions that cannot immediately perform major upgrades)

Scale and Coverage

• The number of validated and remediated package versions available through Lightwell has grown from approximately 6,500 to more than 8,000, including corrections for 64 previously undisclosed vulnerabilities .
• The free-access programme initially covers more than 185 research universities and 100 NGOs and think tanks in the United States .

Broader Context: AI Safety Challenges Driving These Initiatives

Both announcements address a set of interconnected structural risks in the AI era:

• Open-source dependency risk in AI stacks: Modern AI software stacks are deeply dependent on open-source packages, and vulnerabilities in those packages can be exploited by AI-powered attackers at scale .
• Policy-to-engineering gap: Organisations struggle to turn broad AI principles (like those in the EU AI Act) into operational controls that engineers can deploy and auditors can verify. asago is a direct response to that fragmentation .
• Under-resourced public-interest institutions: Universities and NGOs often lack the cybersecurity personnel and budget to secure their open-source dependencies, making them vulnerable to attack .
• AI-enabled threats: The same AI capabilities that help defenders identify weaknesses faster can also help attackers discover and exploit vulnerable systems .

Steven Huels, Red Hat's VP of AI Engineering, described the challenge: "As organisations transition from experimental AI pilots to long-running, autonomous agents, establishing clear operational guardrails becomes a critical infrastructure requirement" .

These announcements build on the USD 5 billion Project Lightwell commitment announced in May 2026 , the Open Secure AI Alliance (launched by NVIDIA with Red Hat as an inaugural member) , and broader industry recognition that "no single organisation can tackle [AI safety and security challenges] alone" (Sarah Bird, Microsoft) .