Anthropic launched OSS Scanner, a free opt-in vulnerability scanner for open-source projects. It uses Anthropic’s strongest models to generate unvalidated reports with patches. Projects must enroll via a GitHub PR and meet critical infrastructure criteria. The scanner builds on Project Glasswing experience and Claude Mythos. It has already found over 29,000 candidate vulnerabilities in major projects. Only 6,000 were manually reviewed due to human capacity limits. Maintainers can request bulk submissions of unverified reports. 88% of 97 tested critical and high-severity findings met CVD standards. The service is now available to more open-source projects.
What changed
Open-source projects received mostly low-quality vulnerability reports from AI tools.
What it unlocks
Receiving unvalidated, model-generated vulnerability reports with patches for open-source projects.
- 29,000 candidate vulnerabilities found
- 6,000 manually reviewed
- 5,000 unverified reports sent to maintainers
- 88% of 97 critical/high findings validated
What you need to act on it
- opt-in enrollment by core maintainers
- project meets critical infrastructure criteria
Sources