Artificial Intelligence · Cybersecurity
Anthropic launches OSS Scanner for open-source projects
Anthropic introduced OSS Scanner, an opt-in service that sends model-generated vulnerability reports to open-source maintainers, while also outlining enrolment rules, early uptake figures and a broader defence programme.
- Anthropic launched OSS Scanner as an opt-in vulnerability scanner for open-source projects.
- The company said the scanner's reports would be generated by its strongest models, including Claude Mythos, without human review or triage.
- Project maintainers can enrol by opening a pull request on the OSS Scanner GitHub repository with a YAML file that supplies required project and contact details.
- Anthropic said 116 pull requests had been submitted, more than 29,000 candidate vulnerabilities had been identified, and 584 advisories had been issued by 2 October 2026.
- Anthropic also unveiled the Critical Infrastructure Defense Program and said it expected AI to favour defence within two years.
Anthropic introduced OSS Scanner as an opt-in service for open-source projects and said it would provide periodic security scans at no cost. It said the outputs would be generated entirely by models, without human review or triage.
Core maintainers were told to join by submitting a pull request to the OSS Scanner GitHub repository with a YAML file. Anthropic said the file had to include the repository to be cloned, the main contact email address and a Dockerfile path, and it could also include extra contacts, a project home page, a GPG key, a threat model file and an opt-out flag.
The company said it would use selection criteria similar to Google's OSS-Fuzz, although it said the process could change over time. It also advised maintainers to add a short explanation when a project's importance was not obvious.
Anthropic said 116 pull requests had been submitted. It said its systems had found more than 29,000 candidate vulnerabilities in major software projects, reported a little over 6,000 flaws to maintainers and generated 584 advisories by 2 October 2026.
Anthropic said it would not apply a 90-day disclosure period to findings by default because some reports could be false positives. It said a disclosure period could later be used for some high-severity reports after manual validation under its CVD policy, and it separately unveiled the Critical Infrastructure Defense Program as part of its Cyber Mission.
Named in this story
Companies
- Anthropic
- unveiled OSS Scanner and the Critical Infrastructure Defense Program
- was named in the comparison point Anthropic used for project selection
Organisations
- Critical Infrastructure Defense Program
- the defence initiative Anthropic unveiled alongside the scanner
- Cyber Mission
- the wider effort under which Anthropic placed the new defence programme
Products and systems
- OSS Scanner
- the opt-in vulnerability scanner Anthropic launched
- Claude Mythos
- one of the models Anthropic said would generate reports
- Project Glasswing
- the earlier effort Anthropic cited as experience behind the scanner
- OSS-Fuzz
- the project-selection model Anthropic said it would use a similar approach to
How the source tells it
The article read like a company launch, mixing product promotion with a warning about AI-enabled attacks and a forward-looking claim about defence.
- vendor boosterism company claims about its strongest models, free scans and faster reporting were repeated without outside scrutiny
- alarm the piece linked the launch to claims that AI helps bad actors find, exploit and scale attacks
- optimism a company forecast about AI favouring defence in two years was presented as part of the announcement