Anthropic's OSS Scanner: Free AI-Powered Vulnerability Scans for Open Source

Imagine a tool that constantly watches over the world's most critical open source code, sniffing out security flaws before attackers can exploit them. That's exactly what Anthropic is offering with its newly launched OSS Scanner—a free, automated vulnerability detection service powered by its most advanced AI models, including the much-anticipated Claude Mythos.

How It Works: Simple Application, Powerful Scans

Getting your project scanned is surprisingly straightforward. Core maintainers of eligible foundational open source projects can submit a pull request to the OSS Scanner GitHub repository using a standard template. The review criteria mirror Google's OSS-Fuzz, focusing on projects that underpin critical infrastructure and user safety. Once accepted, the scanner runs regular, automated security checks—no manual effort required from maintainers.

From 29,000 Suspects to 6,000 Verified: The Backstory

Over the past six months, Anthropic has been quietly testing this approach, using its latest models to scan core software projects worldwide. The result? More than 29,000 candidate vulnerabilities flagged. But here's the catch: with limited human resources, only about 6,000 have been manually reviewed so far. That's where the new automated scanner comes in—it aims to scale up the process without overwhelming human experts.

Disclosure: Coordinated and Transparent

The scanner doesn't just dump a list of bugs and disappear. Anthropic follows its existing coordinated vulnerability disclosure (CVD) process, manually submitting verified reports to project maintainers. For teams that want immediate details, there's an optional "fast track" to get the information as soon as the AI generates it. Importantly, the scan results are entirely AI-generated—no human verification or classification is included by default. But Anthropic has been testing this automated pipeline across dozens of open source projects in recent weeks.

Accuracy Check: 88% Valid, Just One False Positive

To validate an early version of the scanner, Anthropic brought in senior penetration testing experts to manually verify 97 high and critical severity vulnerabilities across 48 projects. The results were impressive: 85 (88%) met the bar for entering the CVD disclosure process. Of the remaining 12, eleven were real but already known or duplicates from the same scan—and only one turned out to be a false positive. That's a remarkably low error rate for an automated system.

The Road Ahead: Continuous Improvement

Anthropic acknowledges the scanner isn't perfect. The company says it will keep refining the system based on feedback from maintainers and as the underlying models evolve. For open source maintainers, it's a free extra layer of defense. For the broader tech community, it's a sign that AI is moving from code generation to code protection—quietly making the digital world a bit safer.

Key Points

Free service: OSS Scanner offers regular, automated vulnerability scans for open source projects at no cost.
AI-powered: Uses Anthropic's most powerful models, including Claude Mythos, to detect potential security flaws.
Easy enrollment: Core maintainers apply via a pull request on GitHub, similar to Google's OSS-Fuzz criteria.
Proven track record: Over 29,000 candidate vulnerabilities found in six months; early validation showed 88% accuracy.
Coordinated disclosure: Follows CVD process, with an optional fast track for immediate details.
Ongoing refinement: Anthropic will improve the system based on feedback and model advancements.

Anthropic's OSS Scanner: Free AI-Powered Vulnerability Scans for Open Source