Anthropic’s OSS Scanner: Free AI Security Audits for Open Source

Open-source software is in almost everything, from routers to online banking, yet it is often maintained by small teams with no dedicated security budget. Since October 8, Anthropic has offered these projects a free service: OSS Scanner, which regularly searches source code for security vulnerabilities using the strongest Claude models. The twist, and the catch, is that reports go straight to developers without any human review first. Early feedback from major projects such as curl, PostgreSQL and wolfSSL is remarkably positive.

Key takeaways

• OSS Scanner audits participating open-source projects regularly and at no cost, using Anthropic’s strongest models, including Claude Mythos.
• Every report includes a working proof of the vulnerability, an explanation of the flaw and, where possible, a proposed fix.
• The reports are fully machine-generated. In a sample of 97 serious findings, only one was wrong; eleven were real but already known issues.
• Core maintainers of projects with major importance for infrastructure and security can apply, and enrollment works through a pull request on GitHub.
• Unverified findings carry no 90-day disclosure deadline, and Anthropic does not publish them.

Why Anthropic is taking humans out of the loop

The service responds to a volume problem. According to Anthropic, its Frontier Red Team found more than 29,000 candidate vulnerabilities in important software projects over the past six months. It was able to manually review and triage only about 6,000 of them. The bottleneck is no longer the models but the people who check their findings. Anthropic illustrates the leap with the CyberGym benchmark: at the start of last year, language models found less than 20 percent of the vulnerabilities there; this year they find more than 85 percent.

Many maintainers had already taken the shortcut themselves. According to the company, those who received initial reports from Anthropic increasingly asked to simply receive all unverified reports along with proposed patches. Anthropic has already sent nearly 5,000 such reports this way. OSS Scanner now turns that into a standing offer. For projects without the capacity to handle it, the existing route remains: coordinated disclosure, in which experts check every finding first.

The model is Google’s OSS-Fuzz, a long-established service that tests open-source code with fuzzers, programs that bombard software with huge numbers of random or malformed inputs. OSS Scanner instead uses language models that read code, form hypotheses about bugs and back them up with working proof. Each report has three parts: a self-contained reproducer that triggers the flaw, an explanation that includes a bisection showing when the bug entered the code, and a patch where available.

How good are the findings?

The key question with machine-generated bug reports is accuracy. In recent years, open-source developers have complained about a flood of low-quality AI reports that cost time and found nothing. Anthropic therefore asked the penetration testers who normally review its disclosures to assess 97 critical and high-severity findings from 48 projects, produced by an early version of the scanner. Of these, 85, or 88 percent, met the bar for formal disclosure. Eleven were real vulnerabilities but duplicated known issues or other findings. Only one was simply wrong. That is a small sample, and Anthropic concedes that maintainers sometimes said severity ratings were inflated or that the scanner had misunderstood their project’s threat model.

The feedback from the pilot projects is unusually emphatic. The team behind the encryption library wolfSSL reports that of 74 reports received, all but two were valid, and five became officially registered vulnerabilities. curl developer Daniel Stenberg, who has publicly complained about useless AI-generated bug reports in the past, writes that the scanner found, among other things, one of the worst curl vulnerabilities of recent years. Anton Arapov of OpenSSL Corporation calls a report with a real exploit attached “basically job done for an engineer,” because it can be verified right away. During testing, according to Anthropic, the system chained several flaws into exploits capable of unauthenticated remote code execution, one of the most dangerous classes of vulnerability.

How enrollment works

Core maintainers can apply by opening a pull request in the GitHub repository anthropics/oss-scanner. All it takes is a short configuration file with the repository address, a contact email and a Dockerfile that installs all dependencies and builds the project. The scanner builds the software in an isolated virtual machine and then audits it without internet access. A threat model is optional but strongly recommended: in it, a project specifies which inputs count as potentially malicious and how severity should be rated. Reports can be delivered PGP-encrypted, and setting “disabled: true” pauses the service at any time. One important detail: the contact addresses in the configuration are public, so a shared security alias is the better choice.

Not every hobby project gets in. Anthropic follows the OSS-Fuzz criteria and requires a “critical impact on infrastructure and user security,” deciding case by case. How often a project is scanned depends, according to Anthropic, on factors such as demand and how widely the project is used. According to The Hacker News, 116 applications had already been submitted shortly after launch. Projects that are not accepted, or prefer to do their own audits, can apply through the Claude for OSS program for free Claude Max 20x subscriptions to fix vulnerabilities and improve their code.

What projects should consider before signing up

The service is most worthwhile for teams that already handle serious reports quickly and have capacity for more. Anyone already struggling with their issue tracker will get extra work from the scanner, not relief, because responsibility for checking and prioritizing lies entirely with the project. The disclosure policy is a plus: because the findings are unverified, Anthropic sets no 90-day deadline and does not publish them. Only if a finding is later confirmed by humans through the regular disclosure process can such a deadline begin.

The scanner is part of a broader trend. Google, too, now puts AI agents in front of every code check-in to find vulnerabilities before they ship. That the same capabilities also help attackers was shown recently by OpenAI’s classification of GPT-6 Astra as the first model with critical cyber capability.

Bottom line: speed as a defense

OSS Scanner rests on a sober calculation. If models find vulnerabilities faster than humans can verify them, and if exploits can now be developed in minutes, as Anthropic says, then an unverified but mostly accurate report with a patch is worth more than a verified one that arrives months later. The numbers from the pilot suggest the math works, at least for well-organized projects. Whether it also holds for the many small libraries the internet depends on just as much will only become clear once the service reaches them. For users, the effect is indirect but tangible: anyone who keeps their software up to date benefits from every vulnerability a project now closes sooner.