Menu
SUBSCRIBE
SUBSCRIBE
Menu

Application Security

The OASIS logo, a wasp inside a bold circle beside the words WASP and OASIS, on the new OWASP fix initiative

OWASP Launches OASIS To Automate Fixes For Open-Source Software Vulnerabilities

, , , , , , , , , , ,

AI-generated fixes will undergo human review before open-source maintainers decide whether to accept, change, or reject them.

 

The Open Worldwide Application Security Project (OWASP) launched a new initiative designed to close the gap between identifying vulnerabilities in open-source software and finding and deploying the fixes. Open-source components are used in a wide range of software, from commercial applications to systems that support critical infrastructure. In its launch announcement, OWASP cited a 2026 Black Duck report finding that open-source code appeared in 98% of the commercial codebases examined.

This means a vulnerability in one widely used component can create risks for many businesses. The problem is growing as automated security tools and AI make it possible to find more flaws, while open-source maintainers must still develop and test the fixes.

The Open Automated Security Initiative for Software, or OASIS, will use AI to generate proposed fixes and application-security professionals to review them. Fixes that pass that review will be submitted to the affected open-source projects, whose maintainers will decide whether to use them.

Rather than creating another tool that identifies problems, OASIS aims to turn vulnerability reports into fixes that open-source maintainers can evaluate and deploy.

AI will generate fixes for human review

OASIS will use automated tools to scan widely used open-source software for vulnerabilities and generate proposed code changes to address them.

Security specialists from companies and other organizations who volunteer through OASIS will review each proposed fix. They will assess whether the reported vulnerability is genuine, whether the change addresses it correctly, and whether the fix could create other security or operational problems.

A fix that clears this review will be considered credible enough for the affected project to evaluate. The project’s maintainers will still test the fix and decide whether to accept, modify, or reject it.

OASIS has not named its first projects

OWASP said hundreds of software-security specialists registered to participate before OASIS formally launched. AppSecAI, Intigriti, and DryRun Security are its founding industry members.

OWASP has not identified the first open-source projects OASIS will examine or said when it expects to submit its first proposed fixes. The initiative plans to track how many fixes open-source maintainers ultimately accept as one measure of whether its approach works.

Google CodeMender interface displaying AI analysis of software vulnerabilities and proposed code patches.

Google Begins Limited Customer Testing of CodeMender AI Security Agent

, , , , , , , , ,

Selected customers can now evaluate CodeMender through Google’s Gemini platform, but they cannot yet deploy its vulnerability scans or proposed patches in commercial software.

 

Google began allowing a limited number of customers to test CodeMender, an AI agent that finds, verifies, and proposes fixes for security flaws in software code.

The announcement does not introduce a new AI security capability. Google described CodeMender’s main functions in late May when it announced AI Threat Defense, a broader platform that combines several Google security products. At the time, Google said customers would test CodeMender through its Gemini Enterprise Agent Platform.

What changed this week is that CodeMender has formally entered public preview. Customers can now request access through their Google Cloud sales teams and test the agent as a managed service through the Gemini platform.

Despite the “public preview” label, access is limited. Google’s documentation says CodeMender is available only to selected customers and may not be used for commercial or production purposes. The company says the preview is intended solely for testing and evaluation.

CodeMender focuses on software code

CodeMender scans a company’s software for vulnerabilities, builds test attacks to determine whether suspected flaws can be exploited, and generates proposed patches for confirmed problems.

The agent runs those tests in an isolated environment controlled by the customer. It then tests the proposed patch to check whether the change fixes the vulnerability without disrupting other parts of the software.

Developers manually review and approve patches before they are added to a company’s code repository.

Google’s documentation warns that CodeMender may modify files or execute commands on a customer’s system and recommends running it in an isolated environment.

The preview supports C, C++, Go, Java, JavaScript, Python, Ruby, Rust and TypeScript. Customers can choose among several Google Gemini models depending on the type of scan they want to run. Google said CodeMender will support advanced models from other companies later this year.

CodeMender: One piece of AI Threat Defense

CodeMender is a specialized code-security agent. AI Threat Defense is the broader security platform that combines CodeMender with Wiz, Mandiant, and other Google security products.

Within that platform, CodeMender handles software code. Wiz adds information about how applications and cloud resources are deployed and exposed, allowing security teams to determine which vulnerabilities present the greatest risk. Other parts of AI Threat Defense monitor systems for attacks and support incident response.

Google’s latest announcement says Wiz will eventually be able to direct CodeMender to scan software and propose fixes using that broader security information. CodeMender scanning through the Wiz integration is still listed as “coming soon.”

Customers can test CodeMender directly through the Gemini Enterprise Agent Platform without using the full AI Threat Defense platform.

Google has not announced general availability, pricing, or a timeline for allowing companies to use CodeMender in commercial systems.