Anthropic has introduced an opt-in vulnerability-finding service for open source software.
Anthropic launched OSS Scanner, a free, opt-in service that uses its strongest language models, including Claude Mythos, to automatically scan open source projects for security vulnerabilities. Building on their experience with Project Glasswing, this initiative aims to help maintainers patch weaknesses before attackers can exploit them.
AI-driven vulnerability detection has advanced rapidly. On the CyberGym benchmark, LLMs went from discovering under 20 per cent of vulnerabilities early last year to over 85 per cent currently, yielding significantly higher-quality bug reports. Through recent scans of critical software, their models identified over 29,000 potential vulnerabilities. However, human review capacity created a bottleneck, allowing them to triage only about 6000 of them.
Recognising that exploits can now be developed in minutes, maintainers increasingly request bulk submissions of unverified findings to accelerate patching. To meet this demand, Anthropic’s offering two paths:
Coordinated vulnerability disclosure (CVD): Continue manually reviewing and disclosing findings for projects that lack the resources to triage reports themselves.
OSS fast-track scanner: Maintainers can opt in to receive fully model-generated reports instantly without human review. While this automated approach enables faster and more frequent audits, it carries a risk of occasional invalid reports.
Inspired by Google’s OSS-Fuzz, OSS Scanner complements Claude Security—Anthropic’s enterprise code-scanning product—by bringing free, high-powered defensive capabilities directly to the open source community.
