# OWASP Agent: OpenCRE’s AI Guide to OWASP, Explained

> OpenCRE launched OWASP Agent, an AI assistant that answers from all of OWASP plus NIST, ISO and MITRE, with source links. What it does, limits, how to use it.

Source: https://playciso.com/blog/owasp-agent-opencre-ai-security-assistant · Published: 2026-11-01 · Publisher: PlayCISO (https://playciso.com)

Primary source: https://opencre.org/chatbot

---

**OpenCRE has announced OWASP Agent**, an AI assistant that answers security questions from the whole body of OWASP Foundation knowledge, alongside the NIST, ISO, CSA, MITRE and other standards OpenCRE already links, and **points you to the source documents** behind each answer. The public chat lives at [opencre.org/chatbot](https://opencre.org/chatbot). What we checked (1 November 2026) - Announced by OpenCRE: OWASP Agent “unlocks the complete body of knowledge of OWASP Foundation”, next to the standards already in OpenCRE, with answers that link to OWASP documents and OpenCRE topics. - Seen on opencre.org: a public, no-sign-in chat titled “OWASP OpenCRE Chat”, an accuracy disclaimer, a privacy note, and Software Improvement Group credited for sponsoring model operation. - Not confirmed: an exact launch date, whether every OWASP project is already indexed in the live chat, which model it runs on, and any usage figures. ## What OpenCRE announced OWASP runs hundreds of projects, and OpenCRE’s announcement makes the honest point that good ones struggle to reach the people who need them. OWASP Agent is its answer: one assistant that knows the OWASP projects and the external standards OpenCRE maps, and that answers with links rather than a bare paragraph. OpenCRE gave three examples: - “What is the difference between the OWASP AI Exchange and the OWASP GenAI Security Project?” An answer with a link to the AI Exchange section that discusses it and to the OWASP board-meeting notes where it came up. - “How do I prevent cross-site scripting?” A summary, links to several OWASP documents, and a link to the XSS topic on OpenCRE, which in turn leads to NIST, CSA, ISO and MITRE material. - “Who should join a threat modelling session?” What the different OWASP projects say, with links and a pointer to the OpenCRE threat-modelling topic. ## How it works: OpenCRE underneath [OpenCRE](https://opencre.org/) (Open Common Requirement Enumeration) links each section of a standard to a **Common Requirement**, so that section also links to every other standard mapped to the same requirement. Its site lists the OWASP Top 10, ASVS, Proactive Controls, Cheat Sheets, Testing Guide, ZAP, Juice Shop, SAMM, the AI Exchange, the LLM Top 10 and the ML Top 10, plus CWE, CAPEC, NIST 800-53, NIST 800-63b, the Cloud Controls Matrix, ISO 27001, ISO 27002, NIST SSDF and, for AI, NIST, ENISA, BIML, MITRE ATLAS and ETSI. That map is what makes the agent useful. A general chatbot can tell you about XSS; an assistant grounded in a requirement graph can tell you which ASVS control, which cheat sheet and which ISO 27002 clause cover it, and link to each. OpenCRE says it built the chat “in collaboration with Google”. The project was founded by **Spyros Gasteratos** and **Rob van der Veer**, who lead the [OWASP Integration Standards project](https://owasp.org/www-project-integration-standards/), and the code is open source on [GitHub](https://github.com/OWASP/OpenCRE). ## What the chat page says about accuracy and privacy “Answers are generated by a Large Language Model … plus collected key cybersecurity standards from OpenCRE as the preferred source. This leads to more reliable answers and adds references, but note: it is still generative AI which is never guaranteed correct.” “Your question is sent to Heroku, the hosting provider for OpenCRE, and then to GCP, all via protected connections. Your data isn’t stored on OpenCRE servers.” Both notes are worth taking at face value. The references are the point: they let you check the answer. And because questions leave your network for a cloud model, keep them generic. ## How security leaders can use it this week - Control mapping: ask which OWASP, NIST and ISO sections cover a requirement before you write a policy line, then cite the sections, not the chat. - Onboarding: give new AppSec engineers and developers one place to ask “what does OWASP say about X?” and get links to the right project. - Threat modelling prep: pull the relevant cheat sheets and ASVS controls before a session, then run the session itself in our Threat Model Builder or, for AI systems, the LLM Threat Model generator. - AI security programmes: use it to navigate the AI Exchange and LLM Top 10, then check your controls against the OWASP AISVS checklist. - Set a rule: nothing confidential goes into any public AI assistant, this one included, and every answer that reaches a document gets its citation checked. ## Practise what it teaches Knowing what OWASP says about prompt injection is step one; spotting it is step two. Try the [Prompt Injection Tester](/tools/prompt-injection-tester) and the [Indirect Injection Lab](/tools/indirect-injection-lab), or read our explainer on [the OWASP AI Security Verification Standard](/blog/owasp-ai-svs-explained). ## Frequently asked questions ### What is OWASP Agent? OWASP Agent is an AI assistant announced by the OpenCRE project in late October 2026. OpenCRE says it covers the complete body of OWASP Foundation knowledge alongside the security standards OpenCRE already maps, and answers questions with links to the OWASP documents and OpenCRE topics behind the answer. ### Is OWASP Agent free? The OpenCRE chat at opencre.org/chatbot is public and needed no sign-in when we checked on 1 November 2026. The page says model operation is sponsored by Software Improvement Group. OpenCRE’s code is open source on GitHub. ### What is OpenCRE? OpenCRE (Open Common Requirement Enumeration) is an OWASP project that links each section of a security standard to a common requirement, so one topic connects to every standard that covers it. Its site lists OWASP Top 10, ASVS, Proactive Controls, Cheat Sheets, Testing Guide, SAMM, the AI Exchange and the LLM Top 10, plus CWE, CAPEC, NIST 800-53, NIST 800-63b, the Cloud Controls Matrix, ISO 27001, ISO 27002, NIST SSDF and AI sources from NIST, ENISA, BIML, MITRE ATLAS and ETSI. ### Who built OWASP Agent? OpenCRE was founded by Spyros Gasteratos and Rob van der Veer, who lead the OWASP Integration Standards project. The OpenCRE site says its chat was built in collaboration with Google, and the chat page credits Software Improvement Group for sponsoring model operation. ### Can I trust OWASP Agent’s answers? Treat them as a well-referenced starting point, not an authority. The chat page itself says “it is still generative AI which is never guaranteed correct.” Its value is the links: open the cited OWASP or standard section and check the answer against it before it goes into a policy, audit or board paper. ### Is it safe to paste internal details into OWASP Agent? Keep questions generic. The chat page says your question is sent to Heroku, OpenCRE’s host, and then to Google Cloud, and is not stored on OpenCRE servers. That is a reasonable design, but it is still a third-party AI service, so do not paste code, architecture details, customer data or incident specifics. ## Sources - OpenCRE on LinkedIn: OWASP Agent announcement, late October 2026 - OWASP OpenCRE Chat (opencre.org/chatbot), checked 1 Nov 2026 - OpenCRE home page: standards linked and founders - OWASP/OpenCRE on GitHub - OWASP Integration Standards project _PlayCISO is independent and not affiliated with OWASP, OpenCRE, Google or Software Improvement Group._