Anthropic launched OSS Scanner on Oct. 8 as part of its new Cyber Mission. The free, opt-in service periodically scans eligible open-source projects for vulnerabilities with the company’s most capable models. Reports go directly to maintainers without human review, so project teams must check each finding before acting.
The service is aimed at maintainers who can assess raw findings. Core maintainers apply through a configuration pull request; Anthropic verifies their role and admits projects case by case, prioritizing software whose failure could affect critical infrastructure or user security. Each report includes a self-contained reproducer — steps to trigger the reported bug — an explanation, and a proposed patch when available.
Anthropic says its models found more than 29,000 candidate vulnerabilities over six months, of which about 6,000 had been manually reviewed. Separately, it had sent nearly 5,000 unverified reports to maintainers who asked to receive all findings. These figures describe model output and handling volume, not confirmed vulnerabilities across the service.
For an early validation, Anthropic says it asked expert penetration testers who review its disclosure findings to assess 97 critical- and high-severity reports across 48 projects. The testers judged 85 (88%) to meet Anthropic's bar for its human-verified disclosure process, which checks findings and coordinates reports with maintainers. Eleven of the other 12 were real but duplicated known issues or other scan findings, and one was invalid. The company also says maintainers have flagged overstated severity ratings and cases where the scanner misunderstood a project’s threat model. This limited, company-reported sample does not show performance across routine scans or whether the service reduces successful attacks.
Sources
- Anthropic Frontier Red Team: OSS Scanner launch and early validation
- Anthropic OSS Scanner eligibility and service details
- Anthropic Cyber Mission announcement
Image: Coding-workspace stock photo, not a scanner demonstration. Photo by Bayu Syaits under the Unsplash License.