Anthropic OSS Scanner: How Claude Finds Vulnerabilities in Open-Source Software

For years, open-source maintainers have faced a difficult imbalance. Their software may be used by millions of people, yet security reviews often depend on a small number of volunteers, limited funding, and researchers who discover vulnerabilities on their own schedules.

Artificial intelligence is beginning to change that equation.

On October 8, 2026, Anthropic launched OSS Scanner, a free, opt-in vulnerability discovery service for qualifying open-source projects.

The service uses Anthropic’s advanced language models, including Claude Mythos, to inspect source code, identify potential vulnerabilities, generate reproductions, and suggest fixes.

Unlike traditional commercial code scanning products, OSS Scanner is designed specifically for open-source maintainers. Its defining feature is that projects can receive model-generated vulnerability reports without waiting for Anthropic to complete manual security validation.

According to Anthropic’s official launch announcement, the initiative grew out of the company’s experience with Project Glasswing and its broader research into AI-assisted vulnerability discovery.

The launch raises an important question for software security: what happens when the limiting factor in vulnerability discovery is no longer finding bugs, but validating and fixing them?

What Is Anthropic OSS Scanner?

Anthropic OSS Scanner is a managed vulnerability-finding service that periodically analyzes participating open-source software projects.

Eligible maintainers enroll their repositories and receive security findings generated by Anthropic’s strongest models.

The service is provided at no cost to accepted projects.

Instead of functioning like a simple source code linter, the scanning process uses AI agents capable of examining program behavior, investigating suspected bugs, generating candidate reproductions, and proposing patches.

Anthropic states that reports can include an explanation of the vulnerability, a reproducer, an attempt to identify when the bug was introduced, and a suggested patch when one is available.

That structure is important because a vulnerability report is much more useful when a maintainer can validate the behavior and understand its underlying cause.

Feature	OSS Scanner
Provider	Anthropic
Launch date	October 8, 2026
Primary users	Eligible open-source maintainers
Cost	Free for accepted projects
Models	Anthropic’s strongest available models, including Claude Mythos
Enrollment	Opt-in GitHub pull request
Analysis approach	Agent-based source code vulnerability research
Reports	Model-generated findings, reproductions, and candidate patches
Human review before delivery	Not required
Subsequent scans	Periodic
Report delivery	Email at launch

The most consequential design choice is the absence of mandatory human review before reports reach enrolled maintainers.

That makes the service faster and potentially more useful to mature security teams, but also shifts more responsibility for triage to the recipients.

Why Anthropic Launched OSS Scanner

The new service reflects a dramatic increase in the number of vulnerabilities AI systems can identify.

Anthropic reported that its models had discovered more than 29,000 candidate vulnerabilities during the preceding six months.

However, the company had only been able to manually review and triage approximately 6,000 findings.

The gap between discovery and verification was becoming an operational bottleneck.

Anthropic also reported that maintainers had requested bulk access to findings even when they had not undergone human validation. The company said it had sent nearly 5,000 such reports at maintainers’ request.

This is a fundamentally different problem from the early wave of AI-generated security reports that often lacked sufficient evidence or technical accuracy.

As models become more capable of identifying legitimate bugs, the primary challenge shifts toward deciding which findings deserve investigation, how to reproduce them, and which patches are safe to merge.

OSS Scanner is Anthropic’s attempt to give maintainers faster access to that growing stream of discoveries.

How Claude-Based Vulnerability Scanning Works

Traditional static application security testing, or SAST, generally relies on rules, dataflow analysis, symbolic techniques, or other program analysis methods to identify suspicious code patterns.

AI-driven vulnerability research can operate differently.

A language model can read code, connect behavior across functions, reason about how inputs reach sensitive operations, and form hypotheses about conditions that might lead to a vulnerability.

An agent can then use development tools to investigate those hypotheses.

For example, consider a parser that accepts a length field from an untrusted file.

A conventional scanner may flag an unchecked allocation or arithmetic operation based on a recognizable pattern.

An AI agent may attempt to reason about the broader execution path: whether the length is validated earlier, whether another function trusts it, what conditions are required to reach the vulnerable path, and whether a test case can demonstrate incorrect behavior.

That does not guarantee the model’s reasoning is correct.

The advantage is that the analysis can incorporate relationships between functions and higher-level program behavior rather than depending exclusively on predefined signatures.

Anthropic states that its OSS Scanner pipeline uses multiple agents and techniques to check findings, investigate root causes, and prepare potential patches.

The service is also intended to support deeper analysis than a conventional quick scan.

However, Anthropic has not publicly committed to one fixed scanning algorithm that applies identically to every project, and the service should not be represented as a single deterministic vulnerability-detection technique.

What Do the Accuracy Results Actually Show?

Anthropic published several quantitative results, but they describe different stages of its research process.

The company reported more than 29,000 candidate vulnerabilities discovered over six months and approximately 6,000 manually reviewed reports.

Separately, it described a validation exercise involving 97 critical or high-severity findings across 48 open-source projects.

In that evaluation, 85 findings met the company’s coordinated vulnerability disclosure standard, representing approximately 88% of the selected sample.

Of the remaining 12 findings, 11 were real issues that duplicated known vulnerabilities or other discoveries from the scan. One was classified as invalid.

These are promising results, but they should be interpreted carefully.

Reported metric	What it means
More than 29,000 candidates	Potential vulnerabilities discovered by models
Approximately 6,000 reviewed reports	Findings manually triaged by Anthropic
97 evaluated findings	Selected high- and critical-severity reports
85 accepted findings	Met Anthropic’s validation standard
11 duplicate findings	Real issues but duplicative
1 invalid finding	False positive in that evaluation

The 88% result is not a universal accuracy guarantee for all future OSS Scanner reports.

The evaluated sample consisted of selected high- and critical-severity findings, not a random sample of every candidate.

Results may vary across programming languages, project maturity, architecture, vulnerability category, and the quality of project-specific context.

Anthropic has also acknowledged that severity assessments may be inflated or that the scanner may misunderstand a project’s threat model.

This transparency is important because a sophisticated reproducer does not necessarily prove that an issue is exploitable under realistic deployment conditions.

Early Feedback From Major Open-Source Projects

Anthropic’s announcement included feedback from maintainers associated with PostgreSQL, OpenSSL, wolfSSL, curl, and other projects.

The responses suggest that high-quality vulnerability reports can help maintainers prioritize meaningful security work.

In one example, wolfSSL reported receiving 74 findings, of which all but two were considered valid. Five resulted in CVEs, according to its quoted maintainer.

The curl project’s maintainer also reported that the scanner helped identify multiple issues worth addressing.

These examples provide more practical evidence than benchmark performance alone because they involve developers evaluating findings against real software.

Still, they should not be interpreted as proof that every project will receive the same volume or quality of results.

The effectiveness of an AI security review depends partly on the codebase, the threat model, and the ability to reproduce a suspected issue.

How Open-Source Maintainers Can Enroll

Anthropic’s OSS Scanner documentation explains that project maintainers can enroll through the public OSS Scanner GitHub repository.

The enrollment process uses a configuration file stored under projects/<project>/project.yaml.

The file identifies the repository, a contact address, and the build environment required for scanning.

An illustrative configuration could look like this:

repo: https://github.com/example-org/example-project
primary_contact: security@example.org
Dockerfile: .oss-scanner/Dockerfile
threat_model: .oss-scanner/threat_model.md

This example is schematic and must be adapted to the actual project and repository layout. The field names reflect Anthropic’s documented configuration interface.

The Dockerfile is especially important because the scanner needs a reproducible environment in which it can build, examine, and test the software.

Anthropic allows the build environment to install required dependencies, but the scanning agents operate without internet access after the environment has been prepared.

Maintainers can also provide threat model information describing important security assumptions, expected trust boundaries, relevant attack surfaces, and areas that should be excluded from testing.

Such context can improve the relevance of model-generated findings.

Why Threat Models Matter for AI Vulnerability Discovery

A code fragment can appear dangerous in isolation while being safe under the application’s actual security assumptions.

For example, a function that accepts an arbitrary file path may be risky if an untrusted network user controls its arguments, but ordinary if the function is accessible only to a trusted local administrator.

A vulnerability scanner that ignores this difference may report a valid-looking issue with an unrealistic attack scenario.

Anthropic allows maintainers to provide an optional threat model to guide the scanner.

That file can explain which inputs should be considered adversarial, which components are security-critical, how severity should be assessed, and what kinds of proof of concept are useful.

This approach is particularly relevant for AI-assisted analysis because language models can use contextual descriptions to evaluate the significance of a code path.

However, developer-provided context should complement—not replace—independent verification.

A useful scanner must still be able to identify assumptions that are incorrect or security boundaries that fail under unexpected conditions.

Why Unreviewed Vulnerability Reports Are Controversial

The decision to send unreviewed AI findings directly to maintainers presents a tradeoff.

The benefit is speed. Projects with capable security teams can begin evaluating suspicious behavior as soon as it is discovered.

The cost is uncertainty.

Some reports may duplicate existing issues, misunderstand exploitability, overstate severity, or contain candidate patches that require substantial review.

A false positive is not always harmless. Maintaining widely used infrastructure already requires significant engineering time, and large volumes of incorrect reports can distract from genuine threats.

Anthropic addresses this by making participation voluntary.

The service is intended for projects that can handle additional security triage and are willing to receive reports that have not passed manual validation.

For projects that do not enroll, Anthropic says it will continue using its existing human-reviewed coordinated disclosure process.

This division allows different projects to choose a reporting workflow that matches their available resources.

How OSS Scanner Handles Vulnerability Disclosure

The disclosure policy is another significant part of the service.

Anthropic states that unvalidated OSS Scanner reports do not automatically impose a 90-day disclosure deadline.

The company argues that it would be inappropriate to enforce strict deadlines on reports that Anthropic itself has not reviewed.

If a finding is subsequently validated through Anthropic’s established coordinated vulnerability disclosure process, the relevant disclosure policy may then apply.

Maintainers can also pause automated reports or opt out of the program.

According to the documentation, reports and associated data are handled using restricted cloud environments, and scanning agents execute in hardened sandboxes with internet access disabled.

These controls are intended to reduce the risk of running security analysis against potentially vulnerable or adversarial code.

OSS Scanner vs. Claude Security vs. OSS-Fuzz

Although these tools and services share a security objective, their roles differ.

Solution	Primary approach	Intended audience
Anthropic OSS Scanner	Model-driven vulnerability research with periodic reports	Eligible open-source maintainers
Claude Security	AI-assisted source code security and remediation	Enterprise and development teams
Google OSS-Fuzz	Continuous fuzzing and automated bug discovery	Eligible open-source projects

OSS-Fuzz uses fuzzing infrastructure to execute software with generated inputs and identify crashes or other defects.

OSS Scanner instead emphasizes agentic vulnerability research using language models.

These approaches can complement each other.

Fuzzing can provide concrete execution evidence, while AI-assisted analysis may explore complex logic and develop targeted test cases that are difficult to discover through untargeted fuzzing alone.

Anthropic explicitly cited Google OSS-Fuzz as an inspiration for the new service.

Frequently Asked Questions

Is Anthropic OSS Scanner free?

Yes. Anthropic provides the service at no cost to eligible accepted open-source projects.

Can any GitHub repository enroll?

No. Anthropic uses eligibility criteria emphasizing projects with significant infrastructure or user security impact, with applications evaluated individually.

Does Anthropic manually verify every report?

No. OSS Scanner’s fast-track reports are model-generated and may reach maintainers without human review.

Does OSS Scanner automatically patch vulnerabilities?

Reports may include candidate patches, but maintainers remain responsible for evaluating and applying changes. Enrollment does not mean that AI-generated fixes are automatically merged.

Is OSS Scanner the same as Claude Security?

No. OSS Scanner is a free, opt-in service for eligible open-source projects, while Claude Security is a separate commercial offering for software security workflows.

Final Thoughts

Anthropic OSS Scanner represents a meaningful change in how AI security research can reach open-source software projects.

The technology is not merely being used to classify already known vulnerabilities. It is being applied to discover previously unknown security defects, create reproductions, and propose remediations.

But the underlying challenge has not disappeared.

A vulnerability candidate still needs to be understood, reproduced, prioritized, and fixed without introducing new problems.

The most important shift may therefore be organizational rather than purely technical.

As AI models make vulnerability discovery faster and less expensive, human security engineering increasingly becomes the process of deciding which findings are real, which matter most, and how to fix them safely.