Anthropic Adds Opt-In Security Scanning for Critical Open-Source Projects

AI company Anthropic has launched OSS Scanner, a free, opt-in service to find vulnerabilities in open-source projects. Enrolled maintainers receive periodic security reports generated by the company's strongest models, including Claude Mythos. The reports are sent without human review, and project maintainers can choose to validate their findings and decide which proposed fixes to accept.

In its 8th October announcement, Anthropic's Frontier Red Team explains that human validation has become a constraint. Over six months, its models identified more than 29,000 candidate vulnerabilities, but researchers manually reviewed and triaged approximately 6,000. Maintainers who wanted earlier access had already received nearly 5,000 unverified reports, together with proposed patches, after asking for them.


Each scanner report includes a self-contained reproducer and an explanation of the suspected vulnerability. Where possible, it identifies the change that introduced the bug through bisection and supplies a candidate patch. This extends work conducted through Project Glasswing, which InfoQ covered in April when Anthropic restricted Mythos Preview access to participating organisations.

PostgreSQL maintainer Noah Misch said fast-track access had helped the project address issues before a general-availability release:

"Several reports came with fixes we can use nearly as-is"
Noah Misch, PostgreSQL

The company tested an early scanner version by asking penetration testers to assess 97 critical and high-severity findings across 48 projects. Of these, 85 met its coordinated vulnerability disclosure criteria. Eleven others were real but duplicated known issues or other scan findings, while one was invalid. These results describe that selected sample, rather than establishing an accuracy rate for every report the service will produce.

Anthropic have however acknowledged that some maintainers have seen some inflated severity ratings and misunderstandings of the threat models around their projects. OpenSSL Corporation's Anton Arapov nevertheless described the raw reports as "as good and sometimes better than what we get from people", particularly when a working exploit made verification straightforward.

wolfSSL's Todd Ouska reported that candidate patches fitted the project's existing verification and remediation process:

"of the 74 reports we received, all but two were valid, and five became CVEs."
Todd Ouska, wolfSSL

There is also a maintainer-confirmed example outside the announcement. curl's Daniel Stenberg attributed an HTTP/2 upload use-after-free vulnerability to Luna Tong at Anthropic using OSS Scanner. Fixed in curl 8.23.0, CVE-2026-92392 could permit remote code execution under specific conditions. Stenberg rated it high rather than critical because successful exploitation would be difficult; a crash was the more likely outcome.

Anthropic cites Google's OSS-Fuzz as an inspiration, although OSS Scanner uses language models to investigate code. Another comparison is Google DeepMind's CodeMender, reported by InfoQ in October 2025. In that launch announcement, researchers Raluca Ada Popa and Four Flynn described automated patch validation using program analysis and testing. They retained human review before upstream submission, unlike OSS Scanner's direct delivery of unreviewed findings.

The work that follows discovery also features in community commentary. Varun Badhwar wrote on LinkedIn: "An upstream patch doesn't help much if you're stuck three major versions behind." Badhwar, CEO and co-founder of application security vendor Endor Labs, argued that enterprises need to establish whether vulnerable code is reachable and whether they can adopt a fix without breaking applications.

Dimitrios Thomas wrote on LinkedIn, in a personal capacity, that evaluations should consider "validation accuracy, maintainer workload and time from discovery to a deployed fix". His suggested measures extend beyond the number of vulnerabilities reported.

The scanner FAQ describes agents that double-check bugs, propose patches and analyse root causes before reports are emailed. This automated checking is separate from human review. Subsequent scans look for newly introduced problems and issues missed previously; their frequency depends on factors including project usage and the service's workload.

Core maintainers enrol through a GitHub pull request containing project configuration and a Dockerfile that prepares the build and dependencies. Scanning runs without internet access after setup, and an optional threat-model file can document scope and severity expectations. Eligibility is assessed case by case, with priority given to established projects important to infrastructure and user security that can already handle verified high-severity reports.

Maintainers can use the threat-model document to identify untrusted inputs, exclude components and explain how they judge severity. It can also specify preferred report formats and patch expectations. Anthropic checks enrolment requests manually to confirm the applicant is a core maintainer and that findings will reach an authorised project security contact.

Projects can pause reports or withdraw. Unvalidated findings carry no automatic 90-day disclosure deadline, although a report later validated manually can enter the separate coordinated disclosure process, with its 90-day period starting when maintainers are notified of that validation. The company continues to offer human-reviewed disclosures, particularly for projects without the resources to triage raw findings.