Anthropic Launches Free AI-Powered OSS Scanner to Hunt Security Flaws in Open-Source Projects

Image: Collected

Anthropic has launched a free, opt-in security service called OSS Scanner that will regularly scan eligible open-source projects for vulnerabilities using its most capable artificial intelligence models, including Claude Mythos. The announcement, made on Thursday, is part of the company’s new Anthropic Cyber Mission, a broader effort to strengthen digital defences at a time when AI is making it easier for attackers to discover software weaknesses.

The scanner is designed to give maintainers of critical open-source projects a defensive advantage without charging them for the service. Enrolled projects will receive periodic, thorough security scans, with reports that include a proof of concept, an explanation of the vulnerability and, where possible, a suggested fix.

Faster reports, no human check

Unlike Anthropic’s earlier vulnerability-disclosure process, the new reports will be generated by AI and sent directly to project maintainers without human review. Anthropic says this approach will make reports available faster, but it also means that some findings may be inaccurate, including cases where a bug’s severity is incorrectly assessed.

Despite that trade-off, Anthropic expects more than 90 per cent of the scanner’s findings to be genuine bugs. In an earlier test, expert penetration testers reviewed 97 critical and high-severity findings across 48 projects, approved 85 for disclosure and found only one false positive among the remaining cases.

Built from a growing backlog

The service emerged from a major backlog at Anthropic. Over the past six months, its models identified more than 29,000 potential vulnerabilities in widely used open-source projects, but the company had manually reviewed and triaged only about 6,000 of them.

Some maintainers asked Anthropic to share all findings, even those that had not been reviewed by staff. The company said projects that cannot keep pace with raw findings will continue receiving only human-verified disclosures.

Who can enrol

Eligible projects must have core maintainers who submit a pull request to Anthropic’s GitHub repository using the required project template. Anthropic will assess applications case by case, using criteria similar to those of Google’s OSS-Fuzz programme.

The company is targeting established projects that have a “critical impact on infrastructure and user security.” In other words, the offer is not open to every open-source project, but is aimed at software that plays an important role in public infrastructure and digital security.

Early feedback from maintainers

Early users of the service have reported largely positive results. Todd Ouska of wolfSSL said that, of 74 reports received, all but two were valid and five led to CVEs, which are publicly identified security vulnerabilities.

Todd Ouska of wolfSSL said, “of the 74 reports we received, all but two were valid, and five became CVEs.” OpenSSL Corporation’s Arapov added that a report containing a working exploit is “basically job done for an engineer,” because it gives developers both the vulnerability and a clear path to fixing it.

Protecting critical infrastructure

Alongside OSS Scanner, Anthropic introduced a Critical Infrastructure Defense Program for organisations that protect power grids, water systems, transportation networks and other essential services. The programme will provide frontier Claude models, on-site engineers and threat research to security providers working in operational technology.

The programme has 11 founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Andrew Turner of Booz Allen described operational technology as “the next frontier for autonomous AI-enabled attacks.”

Building on Project Glasswing

Both initiatives build on Project Glasswing, which Anthropic launched in April and folded into an expanded Cyber Verification Program on October 6. The company said Glasswing uncovered many vulnerabilities but has not yet reduced cyber risk enough on its own.

Anthropic expects AI to increasingly favour defenders over the next two years, although it acknowledges that attackers may retain an advantage in the near term. The launch also comes after recent reports that frontier AI models were involved in intrusions affecting organisations including Hugging Face, highlighting the growing security stakes of advanced AI systems.