A human seal on AI's security patches: OWASP makes OASIS an official project
OWASP, application security's quarter-century-old foundation, has made OASIS an official project: a community that puts AI-generated fixes for open source vulnerabilities through human validation. The principle is plain: automation proposes, humans decide.
AI has moved to mass production of code and patches; who is going to trust those patches? The answer came from the industry's most neutral address. OWASP, the application security foundation alive since 2001 and keeper of the famous OWASP Top 10, has declared OASIS (Open Automated Security Initiative for Software) an official project. OASIS is a community where human specialists validate AI-generated fixes for open source vulnerabilities, so that maintainers get patches they can actually trust and merge.
The pipeline works like this: static analysis tools, dependency scanners and LLM-assisted generators produce vulnerability candidates and draft patches. None of it goes upstream directly; every candidate enters OASIS as a tracked item with the upstream repo, commit SHA and vulnerability type. Volunteer security validators review the candidates on pull requests in OWASP-controlled forks; only validated fixes get proposed to the original project.
The project's principles read like a one-line manifesto: automation proposes, humans decide. The second principle is just as notable: credibility over headcount; validators whose approved fixes hold up carry more weight in future reviews. Joining is open and free; security folk can sign up as validators at owasp-oasis.org.
Context: yesterday we covered Anthropic's security report, and this week the takeover of corporate codebases by agent-written code. If 70 percent of Uber's pull requests come from agents, the question of who filters the security patches in that flood was the industry's most urgent gap. OWASP's answer calls the oldest human institution of the AI era to duty: the referee.
