Anthropic launches free AI vulnerability scanner for open source

Anthropic has launched OSS Scanner, an opt-in service that gives eligible open-source projects periodic security scans from its strongest models, including Claude Mythos, at no cost. The company says the service grew out of its vulnerability-finding work during Project Glasswing and was inspired by Google's OSS-Fuzz.

The problem it addresses is human capacity. Over the past six months, Anthropic says its models found more than 29,000 candidate vulnerabilities in important software projects. Its staff have manually reviewed and triaged only about 6,000 of them. Many maintainers have asked for everything at once, and Anthropic has already sent nearly 5,000 unverified reports with proposed patches at their request.

OSS Scanner's reports are fully model-generated, with no human review or triage. Each one includes a self-contained reproducer, an explanation of the bug (with a bisection to when it was introduced, where possible) and, when available, a candidate patch. Anthropic acknowledges that some reports may be wrong.

To check an early version, Anthropic's penetration testers reviewed 97 critical and high-severity findings across 48 projects. Of those, 85 (88%) met the bar for the company's coordinated vulnerability disclosure (CVD) process. Eleven more were real but duplicated other findings, and one was a false positive. Maintainers have said some severity ratings were inflated or that the scanner misread a project's threat model. During several weeks of piloting with dozens of projects, the scanner also found vulnerabilities that Anthropic chained into unauthenticated remote code execution exploits.

Core maintainers can enroll by submitting a pull request to a GitHub repository. Eligibility follows criteria similar to OSS-Fuzz's, with decisions made case by case. Anthropic will keep its human-verified CVD process for projects that lack the resources to triage reports themselves.