Menu
SUBSCRIBE
SUBSCRIBE
Menu

vulnerability remediation

The OASIS logo, a wasp inside a bold circle beside the words WASP and OASIS, on the new OWASP fix initiative

OWASP Launches OASIS To Automate Fixes For Open-Source Software Vulnerabilities

, , , , , , , , , , ,

AI-generated fixes will undergo human review before open-source maintainers decide whether to accept, change, or reject them.

 

The Open Worldwide Application Security Project (OWASP) launched a new initiative designed to close the gap between identifying vulnerabilities in open-source software and finding and deploying the fixes. Open-source components are used in a wide range of software, from commercial applications to systems that support critical infrastructure. In its launch announcement, OWASP cited a 2026 Black Duck report finding that open-source code appeared in 98% of the commercial codebases examined.

This means a vulnerability in one widely used component can create risks for many businesses. The problem is growing as automated security tools and AI make it possible to find more flaws, while open-source maintainers must still develop and test the fixes.

The Open Automated Security Initiative for Software, or OASIS, will use AI to generate proposed fixes and application-security professionals to review them. Fixes that pass that review will be submitted to the affected open-source projects, whose maintainers will decide whether to use them.

Rather than creating another tool that identifies problems, OASIS aims to turn vulnerability reports into fixes that open-source maintainers can evaluate and deploy.

AI will generate fixes for human review

OASIS will use automated tools to scan widely used open-source software for vulnerabilities and generate proposed code changes to address them.

Security specialists from companies and other organizations who volunteer through OASIS will review each proposed fix. They will assess whether the reported vulnerability is genuine, whether the change addresses it correctly, and whether the fix could create other security or operational problems.

A fix that clears this review will be considered credible enough for the affected project to evaluate. The project’s maintainers will still test the fix and decide whether to accept, modify, or reject it.

OASIS has not named its first projects

OWASP said hundreds of software-security specialists registered to participate before OASIS formally launched. AppSecAI, Intigriti, and DryRun Security are its founding industry members.

OWASP has not identified the first open-source projects OASIS will examine or said when it expects to submit its first proposed fixes. The initiative plans to track how many fixes open-source maintainers ultimately accept as one measure of whether its approach works.

Black-and-white portrait of Pi co-founders Guy Arazi and Yoni Ramon, whose AI security startup raised $35 million

Pi Raises $35 Million To Automate Software Security Fixes

, , , , , , , , , ,

The company says its platform repairs security flaws the way an engineer would, and customers report cutting triage time by up to 80%.

Pi, an AI security startup, announced it raised $35 million to automate the repair of software security flaws. Calcalist reports the total includes a $25 million Series A led by Third Point Ventures and a $10 million seed round closed in early 2025, led by Brightmind Partners. Investors also include CrowdStrike CEO George Kurtz and Armis founders Yevgeny Dibrov and Nadir Izrael.

Pi’s platform builds what the company calls a “security brain”: a memory of an organization’s source code, cloud infrastructure, design documents, Slack and Microsoft Teams discussions, and past security incidents, including how each one was fixed. The company says that context lets the platform separate flaws that pose real risk from false alarms, then write and apply fixes the way an engineer would. Pi says customers cut the time of sorting real warnings from false alarms by up to 80%.

The company says its users include one of the world’s leading AI labs, cybersecurity companies, a major social network, and companies in the travel and insurance sectors. It did not name them.

Pi was founded in 2025 by CEO Guy Arazi and Chief Product Officer Yoni Ramon. Arazi was a security researcher at Microsoft, where he built defenses and vulnerability detection for Microsoft Defender, Azure, and the Microsoft Security Response Center. Ramon led offensive security at Tesla for more than a decade, running security projects for the company’s vehicle and robotics programs in the US, Europe, and China. He also worked in systems engineering at SpaceX and on projects at other companies led by Elon Musk, including the acquisition of Twitter (now X).

“Models like Anthropic’s Claude-Mythos can now uncover security flaws at a scale no human team can match, but that’s only half the equation for defenders,” said Arazi. “Pi enables organizations to remediate vulnerabilities as quickly as they can be identified.”

Pi has offices in San Francisco and Tel Aviv.