Cybersecurity
Anthropic launches OSS Scanner for open-source projects
Anthropic said its new opt-in scanner would send model-generated vulnerability reports to open-source projects without human review, while giving maintainers a faster disclosure path and periodic scans at no charge.
- Anthropic said it was launching OSS Scanner for open-source projects.
- It said the service would generate reports with its strongest models without human review or triage and would be offered at no cost.
- Anthropic said its latest models had found more than 29,000 candidate vulnerabilities over the previous six months, and it had manually reviewed about 6,000.
- The company said expert penetration testers reviewed 97 critical and high-severity findings from an early version across 48 projects, and 85 met the bar for its coordinated disclosure process.
- Anthropic said it had sent nearly 5,000 reports directly to maintainers after they asked for the full set.
Anthropic said it was starting OSS Scanner, a service for open-source maintainers who wanted automated vulnerability checks. It said enrolled projects would receive periodic scans from its strongest models at no charge, and that the outputs would be produced entirely by its models without human checking.
The company said the scanner grew out of Project Glasswing and its work using Claude to find flaws. It said that over the previous six months its latest models had identified more than 29,000 candidate vulnerabilities, with about 6,000 reviewed by staff.
Anthropic said it had already sent nearly 5,000 unverified reports to maintainers who had asked for the full set, and that it would keep using its existing disclosure process for findings checked by humans. It said the scanner would also be available in a faster track for projects that wanted reports as soon as they were produced.
For one early test, Anthropic said expert penetration testers reviewed 97 critical and high-severity findings from the scanner across 48 projects. It said 85 met the standard for its disclosure process, while the rest were duplicates or invalid, including one false positive.
Anthropic said eligible core maintainers could enrol by filing a pull request to a GitHub repository, and that projects would be accepted case by case under criteria similar to OSS-Fuzz. It said the scanner would use its strongest models, including Claude Mythos.
Named in this story
Companies
- Anthropic
- announced OSS Scanner and supplied the performance claims
- was credited with OSS-Fuzz, which inspired the scanner
Organisations
- Project Glasswing
- Anthropic project whose experience informed the scanner
Products and systems
- OSS Scanner
- new opt-in vulnerability scanner for open-source projects
- Claude Security
- Anthropic's code scanning and patching product for enterprises
- Claude Mythos
- one of the models Anthropic said generated the reports
- CyberGym
- benchmark Anthropic cited for vulnerability-finding progress
- OSS-Fuzz
- open-source fuzzing project Anthropic compared OSS Scanner with
How the source tells it
The piece read like a launch announcement, with upbeat self-promotion and urgency around a new security product.
- vendor boosterism The company repeatedly foregrounded its own models, free access and claimed defensive advantage.
- urgency It framed attackers as racing to exploit flaws and said exploits could be built in minutes.
- novelty It used launch framing and benchmark comparisons to present the scanner as a major new capability.