"Takumi byGMO" Launches New Feature "Takumi Images" to Support Vulnerability Patches

GMO Flatt Security, Inc. (President and CEO: Yasutaka Ide), which operates cybersecurity-related businesses for product development organizations with the mission of "Entrusting the backs of engineers" within the GMO Internet Group, announced that it has launched "Takumi Images," a new feature for its software development protection platform "Takumi byGMO" (hereinafter "Takumi"), on July 8, 2026 (Wed). This new feature supports vulnerability patches for container environments.

By using the container images provided by this feature, patches for known vulnerabilities in systems can be applied with minimal effort. Furthermore, as the images are provided after inspection for known package malware, they can also be utilized as a countermeasure against software supply chain attacks, which have seen a sharp increase this year.

Background of the Launch of the New Feature "Takumi Images"

1. With the Advent of Frontier AI, Vulnerability Response (Software Updates) Becomes Even More Critical

The number of publicly disclosed vulnerabilities (CVEs) continues to increase year by year, exceeding 40,000 annually in 2024 and setting a new record in 2025 (*1). Accelerating this increase is the emergence of "Frontier AI" such as Claude Mythos. While the automation of code analysis and vulnerability research by AI enhances the efficiency of defensive inspections, it is also significantly shortening the period between vulnerability discovery and exploitation (Time-to-Exploit) by attackers.

As a result, current development organizations are required to apply patches more continuously, in larger volumes, and at higher frequencies. In response to Frontier AI, the Financial Services Agency and the Bank of Japan have jointly requested financial institutions and others to take several measures, including increasing human resources for patch application. (※2)

However, in actual development environments, applying patches to base images and their internal OS packages and libraries is a burdensome task involving dependency investigation, reconstruction of builds, and verification of operation, leading to a tendency for such tasks to be postponed. Streamlining and accelerating patch application is a critical topic in the post-Frontier AI era.

(*1) Calculated from sources such as the National Vulnerability Database (NVD) provided by the U.S. National Institute of Standards and Technology (NIST).

(*2) https://www.fsa.go.jp/news/r7/sonota/20260522-5/20260522.html ("Request Regarding Short-Term Measures for Financial Institutions, etc., in Light of Threat Changes Due to Frontier AI")

2. Concurrent Software Supply Chain Attacks Targeting Software Updates

Amidst the demand for high-frequency software updates for vulnerability response, "software supply chain attacks" that target the update process itself have been occurring frequently recently.

For example, in March 2026, the software "axios," downloaded 100 million times weekly, was tampered with, leading to a breach simply by users updating the library. Since March 2026, similar attacks have been frequent, marking an era where the software update process itself carries significant risk.

Current development environments are required to reduce the risks associated with software updates while simultaneously performing high-frequency updates.

What is the New Feature "Takumi Images"?

1. Feature Overview

"Takumi Images" is a feature that provides a set of container images with minimized known vulnerabilities. It offers images for major language runtimes and toolsets, including Node.js, Python, Go, and curl, for both amd64 and arm64 architectures.

Each image is built with a minimal configuration that does not include shells or package managers, significantly reducing the number of components that could contain vulnerabilities. Furthermore, the included packages are continuously updated to the latest upstream versions, incorporating vulnerability patches.

For vulnerabilities for which no fix patch exists or for which it has been determined that they are not affected, VEX (Vulnerability Exploitability eXchange) with the grounds clearly stated will be published, providing triage results in a transparent manner.

2. Respond to Known Vulnerabilities Anytime by Simply Switching Base Images

No major changes to build pipelines or development workflows are required to use "Takumi Images." By simply rewriting the "FROM" line in the Dockerfile, you can migrate to a base image with minimized known vulnerabilities.

Thereafter, even when new vulnerabilities are disclosed, patch application is completed by simply rebuilding based on the latest image. Traditional tasks such as investigating dependent packages and selecting corrected versions become unnecessary.

3. Countermeasures Against Malware Intrusion During Container Image Updates Through Pre-Distribution Verification

"Takumi Images" conducts an inspection for known package malware on all images before their release, and only those that pass the inspection are provided. Furthermore, structural defenses against supply chain attacks are implemented in the construction of the images.

As a result, when proceeding with patch response using "Takumi Images," countermeasures against malware intrusion during patching and software supply chain attacks are naturally implemented.

- "Takumi Images" Website: http://flatt.tech/takumi/features/images

Future Outlook

Going forward, we plan to further expand the range of container images provided, focusing on databases, language runtimes, and middleware. We also plan to detect vulnerability information for which CVE IDs have not yet been assigned and to comply with international compliance requirements.

About GMO Flatt Security, Inc.

GMO Flatt Security is a Japan-based security professional company that has supported DX promotion and software development security across various industries with the mission of "Entrusting the backs of engineers." Based on knowledge gained from in-house development of security products, security support for various companies, and thorough user interviews, we provide personalized, supportive security services to each customer organization.

Suite of Engineer-Focused Services to "Entrust the Backs of Engineers"

- "Vulnerability Assessment & Penetration Testing" by Security Engineers

URL: https://flatt.tech/assessment

- AI Agent "Takumi byGMO" Specializing in Security Assessment and Software Supply Chain Attack Countermeasures

URL: https://flatt.tech/takumi

- Continuous Diagnostic Tool (CSPM) for Cloud Services like AWS "Shisho Cloud byGMO"

URL: https://shisho.dev/ja

- Cloud-Based Secure Coding Learning Platform "KENRO byGMO"

URL: https://flatt.tech/kenro

* Company names and product names mentioned are trademarks or registered trademarks of their respective companies.

GMO Flatt Security, Inc. (URL: https://flatt.tech)

Company Name: GMO Flatt Security, Inc.

Location: Cerulean Tower, 26-1 Sakuragaokacho, Shibuya-ku, Tokyo

Representative: Yasutaka Ide, President and CEO

Business Activities: Cybersecurity-related services

Capital: 430.42 million yen (including capital reserve)

GMO Internet Group, Inc. (URL: https://group.gmo/)

Company Name: GMO Internet Group, Inc. (TSE Prime Market, Securities Code: 9449)

Location: Cerulean Tower, 26-1 Sakuragaokacho, Shibuya-ku, Tokyo

Representative: Masatoshi Kumagai, Representative Director, Group Representative

Business Activities: Holding company (group management function)

Group Businesses

Internet Infrastructure Business

Internet Security Business

Internet Advertising and Media Business

Internet Financial Business

Cryptoasset Business

Capital: 5 billion yen