Gold Eagle vulnerability clearinghouse draws skepticism from experts

The U.S. government's new Gold Eagle clearinghouse promises to harness AI to analyze software vulnerabilities and accelerate patching, but cybersecurity experts are questioning whether the initiative can deliver on its ambitious goals.

Launched in mid-July following a June executive order from President Donald Trump, the program aims to coordinate vulnerability scanning, validate bug reports, and prioritize remediation across critical infrastructure. The Treasury Department leads the effort, with support from the Cybersecurity and Infrastructure Security Agency (CISA).

Yet one month after launch, the clearinghouse faces significant skepticism about its limited scale, voluntary participation model, and ability to integrate with existing vulnerability coordination systems.

Why it matters

As AI tools enable hackers to weaponize newly discovered vulnerabilities within minutes—down from an average of seven days in March 2026—the software industry faces mounting pressure to accelerate patching. A government-backed clearinghouse could help prioritize which flaws pose the greatest risk and coordinate fixes across fragmented supply chains. But if poorly executed, it risks duplicating existing private-sector efforts while creating a high-value target for adversaries.

Private sector pushback

Several security leaders argue the clearinghouse is unnecessary. "There's no need for the government to step in here," said Alex Stamos, chief security officer at AI coding security firm Corridor. "The private sector is doing a great job here."

Stamos and others pointed to CISA's existing mandate for vulnerability coordination, suggesting the administration should rebuild that agency's capabilities rather than create a parallel system under Treasury. The Trump administration previously hollowed out CISA, terminated key collaboration mechanisms, and froze partnerships with infrastructure operators.

Meanwhile, industry-led initiatives including IBM and Red Hat's Lightwell, the Linux Foundation's Akrites, and Chainguard's Athena have already launched to address AI-scale vulnerability reporting.

Where Gold Eagle could help

Despite the criticism, some experts see potential value in specific areas. Katie Moussouris, CEO of Luta Security and a longtime vulnerability disclosure expert, said a clearinghouse that validates findings, deduplicates reports, and routes fixes to affected parties "would convert AI noise into defensive signal."

The program could prove most useful for patching prioritization. The government's unique understanding of nation-state hacking operations and cybercrime trends could help developers identify which vulnerabilities to fix first. The clearinghouse could also support open-source maintainers who struggle to keep pace with security updates and raise awareness of community-created patches for unsupported software versions.

Operational challenges

Gold Eagle will use the Vulnerability Information and Coordination Environment (VINCE), operated by Carnegie Mellon University's Software Engineering Institute, as its intake mechanism. But experts worry CERT/CC lacks sufficient funding and analysts to handle the expected volume of reports.

Centralizing unpatched vulnerability data also creates security risks. "Increased centralization of unpatched vulnerabilities is a juicy target for adversaries," Moussouris said. "Why hack [more than a thousand] open-source projects and closed-source software companies if you can hit the bug jackpot all in one place?"

Treasury's leadership role drew particular criticism. "Vulnerability coordination succeeds or fails on trust, and researchers, maintainers, and vendors have decades of trust built with CERT/CC and working relationships with CISA," Moussouris said. "Treasury has neither the coordination mission nor those relationships."

Experts emphasized the government must set realistic expectations about what one organization can accomplish. "Don't boil the ocean," Moussouris advised. "Understand that there is a capacity limit that one organization can handle that is far below the list of all critical infrastructure software and key open source packages."

These details were first reported by Cybersecurity Dive.