Finding bugs isn’t the bottleneck any more
AI has made finding vulnerabilities in open-source code much cheaper. Tools like OpenAI’s Codex Security, Hadrian’s OpenHack and OpenAnt can scan huge numbers of repositories and produce credible findings at a pace no human team could match. The problem is what happens next: every finding lands on a maintainer, often an unpaid volunteer, who now has to understand it, write a fix and ship a release.
OWASP OASIS – the Open Automated Security Initiative for Software, announced on 26 August – is OWASP’s answer to that imbalance. Its aim is to move open-source remediation from “find and report” to “find, validate and fix”.
How OWASP OASIS works
The process has three stages:
- Generate – automated tools scan open-source repositories and produce a candidate patch alongside each vulnerability they find.
- Validate – AppSec professionals (and supporting agents) review every candidate patch for correctness, safety and practical quality. They can test behaviour, compare the vulnerable and patched code, and reject changes that introduce regressions or hide the risk rather than removing it.
- Deliver – a validated fix goes to the project’s maintainer, who decides whether to test, adapt and merge it. Nothing is forced upstream.
The middle step is the point. A patch that compiles and makes a scanner go quiet isn’t necessarily a correct fix – it might break an edge case, change behaviour users rely on, or simply move the vulnerability somewhere else. OWASP OASIS puts a human expert between the model and the maintainer so that what arrives in a maintainer’s inbox is something worth their time.
Why it matters
Open-source code sits inside roughly 98% of commercial codebases, according to Black Duck’s 2026 Open Source Security and Risk Analysis report. Most of it is maintained by small teams, and many maintainers are already overwhelmed by scanner alerts that describe a problem without offering a usable fix. Adding AI-scale discovery on top of that, without matching fix capacity, mostly produces burnout and a longer list of known-but-unpatched vulnerabilities.
If OWASP OASIS works, it flips the economics: the expensive part (understanding the bug and writing a safe fix) is done before the maintainer is involved, and the maintainer’s job becomes review rather than research.
Who’s behind it
Founding sponsors include AppSecAI, Intigriti and DryRun Security. The project is in alpha and is actively recruiting – particularly validators and community leads. Reviews are designed to be short, focused tasks, so you don’t need to commit huge amounts of time to contribute.
How to get involved
- AppSec practitioners can sign up as validators. Reviewing AI-generated fixes is good practice in its own right: you see a lot of real vulnerabilities and a lot of subtly wrong patches.
- Maintainers should expect to see validated patches arriving and can decide how they want to receive them.
- Organisations that depend heavily on open source can sponsor or contribute staff time – arguably cheaper than patching forks internally.
Things to watch
It’s an alpha, and the hard questions are still open: how validators are vetted, how disagreements between validators and maintainers are handled, and how the project avoids becoming yet another source of noise for maintainers. The primary details also came via OWASP’s announcement and coverage of it, so expect specifics such as sponsors and process to evolve. Still, it’s the most serious attempt so far to make AI-scale vulnerability discovery produce fewer open vulnerabilities rather than longer reports – and that makes OWASP OASIS worth following.
Leave a Reply
You must be logged in to post a comment.