Anthropic launches OSS Scanner, free security scans for critical open-source projects

Anthropic's Frontier Red Team has launched OSS Scanner, a free vulnerability-scanning service for open-source projects. According to Anthropic's announcement, the service scans enrolled projects on a recurring basis with the company's strongest models, including Claude Mythos, and sends findings directly to project maintainers. The service opened on October 8; Anthropic's developer account @ClaudeDevs promoted it again on October 20.

What OSS Scanner is

OSS Scanner is an opt-in scanner inspired by Google's OSS-Fuzz, which continuously hunts for bugs in open-source projects. After a project enrolls, Anthropic scans it and then repeats the scans periodically to find new vulnerabilities and ones missed earlier. According to the service page, the cadence depends on the number of projects in the pipeline, how widely a project is used and other factors. Scans run in isolated sandboxes with internet access fully disabled.

Maintainers receive a bundle of reports by email after each scan. According to the announcement, each report includes a self-contained reproducer, an explanation, a bisection showing which change introduced the bug where possible, and a candidate patch where available. Anthropic states plainly that reports are fully model-generated and sent without human review, so some may be incorrect or invalid.

Why it was launched

According to Anthropic, its models found more than 29,000 candidate vulnerabilities over the past six months, but the company could manually review and triage only about 6,000 of them. After maintainers asked to receive unverified reports in bulk, the company opened this fast track for projects that want reports as soon as they are found. Human-verified reports will keep going out through Anthropic's existing coordinated vulnerability disclosure process, especially for projects without the resources to triage reports themselves.

The announcement also shares pilot results: of 97 critical and high-severity findings checked across 48 projects, 85 met Anthropic's disclosure bar, 11 of the rest were real but already known, and only one was a false positive. The page includes comments from maintainers of projects such as PostgreSQL, OpenSSL, curl and wolfSSL.

Who can join, and how

The service is open to established projects with a critical impact on infrastructure and user security; the criteria resemble OSS-Fuzz's and each project is evaluated case by case. Factors include the project's age, update frequency, how many people and projects depend on it, its OpenSSF criticality score and its license. Brand-new projects and most forks typically do not qualify. Anthropic says the service is meant for projects that can keep up with high and critical-severity reports.

To enroll, maintainers open a pull request to Anthropic's oss-scanner repository on GitHub adding a file with the project's repository, primary contact and a Dockerfile that sets up the build environment. A human reviews every sign-up, checking that the requester is a core maintainer and that the security contact appears in the project's SECURITY.md. The service is free.

Disclosure rules

Anthropic says it will not place a 90-day coordinated disclosure period on these unvalidated findings. If a finding is later validated by a human, it may be disclosed 90 days after the maintainer is notified of the validation. The service terms say reports may be used only to find and fix vulnerabilities, may be shared only with authorized maintainers and must be kept confidential until fixed.

The details rest on Anthropic's announcement and service page, and the pilot results are the company's own assessment. Under the service terms, reports may be incomplete or wrong, proposed patches may break functionality and responsibility stays with the maintainer reviewing them. As the number of AI-found vulnerabilities grows quickly, the real question will be whether volunteer maintainers have time to triage and fix these reports. Follow assessments from independent security researchers and open-source maintainers for other perspectives.