Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Anthropic has introduced OSS Scanner, a free, opt-in AI-powered vulnerability scanning tool for open-source projects. The initiative aims to enhance the security of the open-source ecosystem by leveraging AI models like Claude Mythos to identify and report vulnerabilities without requiring human int
Overview of Anthropic's OSS Scanner
Anthropic has launched OSS Scanner, a new initiative designed to improve the security of open-source software by using artificial intelligence (AI) to detect vulnerabilities. The tool is opt-in and free for project maintainers, with the goal of providing periodic, thorough security scans using Anthropic's strongest models, including Claude Mythos. This initiative is informed by the company's prior work with Claude during Project Glasswing, where the AI was used to identify vulnerabilities in software.
Implementation and Configuration
Project maintainers can enroll in the OSS Scanner by submitting a pull request on the tool's GitHub repository, along with a YAML configuration file. This file must include details such as the project's Git repository link, the primary contact's email address, and a path to a Dockerfile that sets up the environment for the security audit. The Dockerfile is crucial for ensuring that the agent can perform its scan offline, without internet access.
Additional optional information that can be included in the YAML file includes CC email addresses for reports, the project's home page, a GPG public key for encrypting emails, and a path to a threat model file. This file can specify what code should be tested, how vulnerabilities should be classified, and the format of the reports.
Reporting and Disclosure Policies
Unlike traditional vulnerability disclosure programs, Anthropic does not enforce a mandatory 90-day disclosure period for findings. This is due to the potential for false positives. However, if a report is later validated manually through Anthropic's existing CVD program, it may be disclosed under the company's CVD policy 90 days after notification. As the tool's performance improves, Anthropic may introduce a disclosure period for high-severity vulnerabilities in the future.
Impact and Performance
Anthropic has reported identifying over 29,000 candidate vulnerabilities in critical software projects, with more than 6,000 flaws reported to maintainers. These findings have resulted in 584 advisories as of October 2, 2026. The company has also launched the Critical Infrastructure Defense Program as part of its Cyber Mission, aiming to protect critical infrastructure and open-source software from AI-enhanced cyber threats.
Anthropic believes that AI will increasingly favor defense in the coming years, making it easier to catch bugs before deployment, write secure software from the start, and actively defend systems using AI models. This initiative is part of a broader effort to equip defenders with the tools needed to combat AI-powered cyber threats and accelerate the development of secure software practices.
Source: The Hacker News. Analysis based on publicly available information; no hands-on testing is claimed.
