OWASP has launched the Open Automated Security Initiative for Software (OASIS), a new community project aimed at accelerating the remediation of vulnerabilities in open-source software through AI-generated patches and human application-security validation.
Announced on August 26, 2026, OWASP OASIS seeks to address a longstanding security gap: organizations and researchers can identify vulnerabilities faster than maintainers can reliably fix them.
The initiative combines automated vulnerability discovery and patch-generation tools with a global community of security practitioners who review candidate patches before they are submitted upstream.
OASIS Fix Open-Source Vulnerabilities
The project is a vendor-neutral effort designed to help open-source maintainers receive credible, reviewed remediation options rather than a high volume of vulnerability alerts or unverified AI-generated code.
“Open source underlies the vast majority of our information economy,” said Chris Holt, Strategic Engagement and Community Architect at Intigriti. “OASIS enables the application security and open-source communities to work together to deliver secure open-source software.”
OASIS employs a three-stage process to move vulnerabilities from detection to remediation more quickly.
First, AI-powered automation scans widely used open-source repositories, identifies security issues, and produces candidate fixes. Instead of merely flagging a flaw, the pipeline attaches a proposed patch to each vulnerability it discovers.
Second, members of the OASIS community, including application security professionals and automation agents, review the candidate fixes for security, correctness, and safety. OWASP states that this validation layer can significantly reduce the time required to determine whether a proposed patch is credible, from days or weeks to mere minutes.
Finally, vetted fixes are shared with upstream maintainers for their own functional and performance testing. Maintainers retain the control to accept, modify, or reject the contributions.
This model is designed to prevent AI-generated code from being automatically assumed to be trustworthy. Instead, OASIS positions human validation as the critical link between rapid machine-generated output and patches that maintainers can reasonably evaluate and integrate.
This project launches amidst rising concerns that generative AI is enabling attackers to identify and exploit software weaknesses more quickly.
OWASP has described this trend as “vibe hacking,” in which AI-assisted workflows reduce the time and expertise required to identify vulnerable code paths and develop exploits.
While the cybersecurity industry has heavily invested in vulnerability discovery, through scanning, bug bounties, software composition analysis, and code reviews, remediation remains challenging.
Maintainers often face limited time, fragmented reports, false positives, and uncertainty over whether suggested fixes will introduce regressions or break compatibility.
OASIS is designed to act as a quality filter for that noise. Human reviewers can assess whether a vulnerability is valid, determine whether an AI-produced patch effectively mitigates the issue, and provide maintainers with a more actionable starting point.
According to OWASP, the initiative has already attracted hundreds of application security professionals from various industries. Founding members include AppSecAI, Intigriti, and DryRun Security.
OWASP stated that OASIS will complement large-scale security initiatives such as OpenAI’s Patch the Planet, the Linux Foundation’s Akrites, and Anthropic’s Project Glasswing.
These programs emphasize high-priority infrastructure and elite research efforts. At the same time, OASIS focuses on broad participation across the extensive network of open-source libraries and enterprise dependencies.
This approach could be particularly significant for enterprises that rely on open-source components but have limited influence over upstream maintenance. A validated fix accepted into an upstream project can simultaneously protect thousands of downstream applications.
Security practitioners, developers, researchers, and open-source contributors can participate in OASIS as vulnerability validators, repository community managers, maintainer liaisons, or automation operators.
By combining the speed of AI with community review, OWASP OASIS aims to shift open-source security from solely identifying flaws to effectively fixing them at scale.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
, a new community project aimed at accelerating the remediation of vulnerabilities in open-source software.){kind=link}