Anthropic launches a free vulnerability scanner for open-source projects

Anthropic opened OSS Scanner, a free, opt-in service that periodically scans open-source projects for vulnerabilities and sends maintainers a reproducer, a bisected explanation of when the bug was introduced, and a candidate patch. The reports are generated by Anthropic’s strongest models, including Claude Mythos, and are sent to maintainers without prior human review — a deliberate choice, the company said, to maximise speed and frequency.

Anthropic reported that six months of prior scanning under the service had surfaced around 29,000 candidate vulnerabilities, of which roughly 6,000 were manually reviewed and triaged and nearly 5,000 sent on to maintainers who requested them. In a validation test of 97 findings rated critical or high severity, 88% met the standard typically required for coordinated vulnerability disclosure. Maintainers at PostgreSQL, OpenSSL and wolfSSL were quoted giving broadly positive assessments; wolfSSL said only two of 74 reports it received were not valid.

The service sits alongside, but is distinct from, Anthropic’s Cyber Mission and expanded Cyber Verification Program, announced the same day, which give vetted security professionals gated access to models with reduced safety restrictions. OSS Scanner instead runs automatically against eligible projects and requires no verification to receive its reports, trading the caution of a gated rollout for broader, faster coverage of the open-source software that much critical infrastructure depends on.