Anthropic Launches OSS Scanner, a Free AI Vulnerability Scanner

Anthropic has launched OSS Scanner, a free, opt-in program that points its strongest models, Claude Mythos among them, at enrolled open-source codebases on a recurring basis. Maintainers enroll with a pull request and a Dockerfile, the audit runs in an isolated VM cut off from the internet, and each report arrives with a reproducer, an explanation, often a bisection to the commit that introduced the bug, and a candidate patch when one exists.

The scale is the story. In the 11 days after the October 8 launch, Anthropic reported 77 critical and 803 high model-rated findings. As of October 19 it had accepted 114 projects from about 650 applications. Open source runs underneath nearly everything, and much of it is kept alive by a handful of volunteers. A tool that finds real bugs at this rate changes how safe that foundation is, and how much work lands on the people holding it up.

We think this is one of the better uses of frontier models we've seen this year, and the early evidence backs that up. When Anthropic's penetration testers audited 97 critical and high findings across 48 projects, 85 met the company's bar for coordinated disclosure. Eleven were real but duplicated known issues. One was invalid. wolfSSL says all but 2 of its 74 reports were valid and 5 became CVEs. curl shipped a fix for a High-severity HTTP/2 upload use-after-free. That is not a flood of hallucinated junk. That is security work.

The design choice we keep coming back to is the one Anthropic made on purpose: no human review before a report goes out. The company is candid about why. Over six months its models surfaced more than 29,000 candidate vulnerabilities, and human reviewers triaged roughly 6,000. Humans are the bottleneck, so Anthropic took them out of the loop and made the program opt-in. That's a defensible trade for maintainers who asked for it. It is also a transfer of labor. The triage that Anthropic isn't paying for now lands on project teams, many of them unpaid.

The weak spots are already visible. Maintainers report inflated severity. Duplicates show up. And the 88% precision figure covers an audited sample of critical and high findings, not the full stream. A maintainer who gets dozens of model-rated criticals has to sort the real fire from the false alarm, and severity inflation is exactly the kind of noise that burns out volunteers. The optional threat model file helps here; without it, the scanner guesses what counts as an attack surface. We'd push every enrolled project to write one.

Then there's the trajectory. If models can find bugs this fast for defenders, the same capability is available, or soon will be, to people who don't file reports. Anthropic ties the timing to benchmark progress: on CyberGym, models went from finding under 20% of vulnerabilities to over 85%. That's the uncomfortable math. The window between a bug being findable and being exploited is shrinking, and open-source maintainers are the ones who have to close it. Programs like this are how defenders keep pace. They only work if patching capacity grows alongside finding capacity.

I'm also watching the disclosure posture. There's no 90-day deadline on unvalidated findings, which is gentler on maintainers than OSS-Fuzz's clock. That's reasonable for model output nobody has confirmed. But it leaves open what happens when a valid, critical bug sits unpatched in a widely used project and the only party that knows is the vendor that found it.

OSS Scanner is run jointly by Anthropic's Frontier Red Team and Safeguards Research team and borrows its shape from Google's OSS-Fuzz, swapping fuzzers for language models. It joins OpenAI's Codex for OSS, which gives approved maintainers tools to run and review scans themselves, and Google DeepMind's CodeMender, which has humans review every patch before it goes upstream. Anthropic's broader disclosure dashboard listed 6,157 disclosed vulnerabilities across 591 projects as of October 2, with 516 patched.