Anthropic launches OSS Scanner: free AI security audits for open source

What this is about

On October 8, 2026, Anthropic introduced the OSS Scanner, a voluntary, free service that regularly scans important open-source projects for security vulnerabilities using the strongest Claude models, including Claude Mythos. It was built by the Frontier Red Team and the Safeguards Research team. The idea builds on experience from "Project Glasswing," in which Anthropic used Claude to hunt for vulnerabilities. The concept resembles Google's OSS-Fuzz, except that language models review the code instead of fuzzers (programs that try to crash software with random inputs).

The core of the offer: reports are generated entirely by the model and delivered without human review or triage. That allows more frequent and faster scans, but leaves it to maintainers to decide whether a finding is real and important.

Why Anthropic is doing this

Over six months, Anthropic found more than 29,000 vulnerability candidates. Human reviewers, including outside security firms, worked through about 6,000 of them. Nearly 5,000 more reports went directly to maintainers who explicitly wanted everything, validated or not. The OSS Scanner turns that special arrangement into an official program. The bottleneck is human review.

The dashboard (as of October 2) lists 29,439 candidates, 6,123 externally reviewed, of which 5,674 were rated valid, 6,157 reports submitted across 591 projects, 584 advisories and 516 known fixes. A candidate isn't a confirmed vulnerability yet, and a fix in the source code doesn't mean users have already applied it.

How participation works

Core maintainers sign up with a pull request to the GitHub repository anthropics/oss-scanner and create a file projects/<project>/project.yaml.

• Required fields: repository link, primary contact (email) and path to a Dockerfile.
• Optional: threat_model (a threat_model.md file), a PGP/GPG key for encrypted reports, auto_ccs, homepage, and disabled: true to stop receiving reports.

The Dockerfile builds the project with network access and installs all dependencies. The audit then runs in an isolated virtual machine with no internet access. Anthropic recommends running the tests in the built container. Reports arrive by email; with PGP encryption, the report goes only to the primary contact. Contact addresses in the configuration are public, so the documentation advises using a dedicated security address.

The agents double-check bugs, analyze the root cause and propose patches. Each report includes a standalone reproducer (code that reproduces the bug), an explanation, a bisection if possible (a search for the commit that introduced the bug) and, where available, a proposed patch. The threat model describes hostile inputs, excluded code and severity rules; without it, the scanner has to guess. Established projects of major importance are accepted, with exposure to remote attacks and the number of users playing a role. Anthropic follows criteria similar to OSS-Fuzz's.

Hit rate and field reports

Penetration testers reviewed 97 critical and high findings from 48 projects, from an early version:

At wolfSSL, 72 of 74 reports were valid, and 5 became CVEs. curl fixed CVE-2026-92392, a high-severity use-after-free bug in HTTP/2 upload (affecting 8.12.0 through 8.22.0, fixed in 8.23.0 on October 14, 2026). According to Anthropic, positive feedback also came from PostgreSQL, OpenSSL and HotCRP. But some maintainers complain about inflated severity ratings and misunderstandings of the threat model. The sample is hand-picked and comes from an early version, so it's no guarantee. Anthropic points to the CyberGym benchmark, where models went from under 20% to over 85% of vulnerabilities found.

Disclosure without a 90-day deadline

The usual practice is to publish vulnerabilities after 90 days. That doesn't apply to unvalidated scanner reports, because they can contain false positives. If a finding is later confirmed by humans through the regular CVD program, it can be disclosed 90 days after that notification. A deadline could apply to some severe findings in the future, with advance notice and an opt-out.

Comparison with other programs

Cyber Mission

The scanner is part of the Anthropic Cyber Mission, also announced on October 8. It includes the Critical Infrastructure Defense Program for operators of power, water and transport networks, offering models, on-site help and threat research. Anthropic expects AI to favor defense within two years.

Our take

The service can give small teams expert analysis they couldn't otherwise afford. An 88% rate is strong, but someone has to take responsibility for the inbox, reproduction and assessment. The backstory calls for caution: curl founder Daniel Stenberg reported in 2025 that about 20% of submissions were AI slop and only about 5% were real vulnerabilities. What matters is how much confirmed work comes out per hour of review. A clean scan doesn't prove security. All figures come from Anthropic or from projects named in its announcement; independent long-term data is missing.