OWASP OASIS adds 1,000 members as it expands open source security effort

OWASP OASIS said 1,000 application security professionals have joined its global effort to validate AI-generated software vulnerability fixes for open source projects. The surge comes as the group scales its grassroots model across regions and languages and pushes maintainers to adopt vetted fixes faster.

Why it matters: - Open source software underpins most modern applications, so faster vulnerability remediation affects developers, maintainers and end users across industries. - OWASP OASIS is trying to reduce the gap between AI-generated fixes and trusted, merge-ready security patches. - The initiative is drawing volunteers worldwide at a time when attackers are increasingly targeting open source code. - The press release cites a claim that 87% of open source code bases contain vulnerabilities.

What happened: - OWASP OASIS announced that 1,000 members have joined the community. - The initiative has attracted application security professionals from North America, South America, Europe, APAC, Australia, the Middle East and Africa. - The group said the members are united to validate AI-generated software vulnerability fixes. - OWASP OASIS launched in late August and has since grown rapidly, generating thousands of fixes for review. - The organization said it now offers community office hours, onboarding sessions and collaborative validation sessions in local languages and time zones. - The initiative invites people to join at owasp-oasis.org. - OWASP OASIS is also a finalist for the SANS Institute Difference Maker Awards, and voting is available through the awards page.

The details: - Members receive access to AI-generated fixes that are crowd-validated before maintainers review and merge them. - The model pairs automation with human review to make the fixes credible enough for open source maintainers to use. - Volunteers can learn to evaluate fixes, validate them or reject them, then share that knowledge with their broader communities. - The community tracks participation through an OWASP OASIS leaderboard. - Michael Cartsonis, co-founder of AppSecAI, said the training helps defenders make a difference in a few minutes at a time. - Cartsonis said more people are joining every day to secure the open source code underlying 98% of the world’s applications. - Chris Holt, strategic engagement and community architect at Intigriti, said app security professionals and AI need to work together to fix open source. - Holt said the combination of fix automation and human validation is what makes OASIS possible. - Mandana Madison, an OWASP OASIS volunteer, said the effort helps cut through noise from untrusted AI-generated slop and gives contributors community credibility. - Madison said the work protects her company and nearly everyone else who depends on open source. - The initiative says it is a vendor-neutral, community-driven OWASP project. - OWASP says it does not endorse any product, services or tools.

Between the lines: - OWASP OASIS is positioning itself as a bridge between AI-assisted remediation and the trust required for real-world adoption. - The multilingual, distributed volunteer model suggests the group is trying to scale validation without relying on a central security team. - The rapid membership growth signals demand for a practical way to turn AI-generated fixes into something maintainers can actually use. - The emphasis on validation also reflects concern that AI can increase output while reducing confidence unless humans check the results.

What's next: - OWASP OASIS is likely to keep recruiting volunteers and expanding validation sessions across more regions and time zones. - The group will continue pushing reviewed fixes toward maintainers so they can merge credible patches more quickly. - Community participation in the leaderboard and awards vote may further raise visibility for the initiative.