AI news · Anthropic · security
Anthropic offers free AI security scans to open-source projects
OSS Scanner sends vulnerability reports written by its models alone, part of a wider push that includes critical infrastructure.
Anthropic launched OSS Scanner on Thursday 8 October 2026, a free, opt-in service that runs periodic vulnerability scans on open-source projects with its strongest models, including Claude Mythos, the company says. No person checks a report before it reaches maintainers. Anthropic accepts some wrong reports as the price of scanning faster and more often.
Its own numbers explain the shift. Over six months, Anthropic’s models flagged more than 29,000 candidate vulnerabilities, of which staff reviewed about 6,000. Nearly 5,000 unverified reports went to maintainers who asked for everything. When its penetration testers checked 97 critical and high-severity findings across 48 projects, 85 met its disclosure bar and one was a false positive. wolfSSL said all but two of its 74 reports were valid.
The scanner is one half of what Anthropic calls its Cyber Mission, The Register reports. The other pairs its models with on-site engineers for critical infrastructure operators, with partners including CrowdStrike, Deloitte, Palo Alto Networks, PwC and Rockwell Automation. Eligibility follows criteria similar to those of Google’s OSS-Fuzz, so only established projects with a critical impact on infrastructure and user security qualify. Some projects already struggle with a flood of AI bug reports, The Verge notes.
Builders who depend on popular open-source libraries get faster fixes if maintainers keep up; the review work moves to the maintainers.
Sources
- Anthropic: An opt-in vulnerability-finding service for open-source software. Checked
- The Verge: Anthropic launches free AI security scans for open-source projects. Checked
- The Register: AI company moves to defend critical infrastructure and open-source projects from AI. Checked
Alexandre S.
Alexandre S. is a creative ad strategist and copywriter with ten years' experience in digital marketing across multiple channels.