Anthropic Opens a Free, Unreviewed AI Vulnerability Scanner to Open-Source Projects

Anthropic has launched OSS Scanner, an opt-in service that runs its strongest models against open-source codebases and ships the resulting vulnerability reports directly to maintainers at no cost. The notable design choice is what the company leaves out: according to Anthropic, the reports are fully model-generated, with no human review or triage before they reach project maintainers. That is a deliberate bet that speed now matters more than the filtering step security teams have traditionally treated as mandatory.

What Anthropic is shipping

The service comes out of the company's Frontier Red Team and builds on work it calls Project Glasswing. Anthropic says that over the past six months it has used recent models to scan major software projects and surfaced more than 29,000 candidate vulnerabilities, of which roughly 6,000 have been manually reviewed and triaged. The gap is the whole point of the announcement: the company says it is bottlenecked on human capacity to validate findings, not on the models' ability to generate them.

Anthropic frames OSS Scanner as a fast track that sits alongside, not in place of, its existing coordinated vulnerability disclosure process. Human-verified reports will continue to flow through CVD, which the company says it will prioritize for projects that lack the resources to triage reports themselves. Projects that want everything immediately can opt into the raw pipeline instead.

Each report is supposed to arrive with a self-contained reproducer, an explanation of the bug, a bisection identifying when it was introduced where that is possible, and a candidate patch when one is available. Anthropic says it validated the pipeline over several weeks with dozens of projects, producing hundreds of bug reports, including multiple issues that could be chained into unauthenticated remote code execution. The reports are generated by the company's strongest models, which it says include one called Claude Mythos; the announcement does not describe that model further.

Enrollment runs through a pull request to a GitHub repository, with eligibility judged case by case against criteria Anthropic says resemble those used by Google's OSS-Fuzz — essentially, projects with critical impact on infrastructure and user security. OSS-Fuzz is the explicit template here: a free, centrally operated scanning service for important open-source code, except with language models in place of fuzzers.

The accuracy numbers, and what they cover

Anthropic reports one internal validation exercise: expert penetration testers who review its CVD findings checked 97 critical- and high-severity vulnerabilities from the scanner across 48 projects. Of those, 85 — 88% — met the bar for the CVD process. Eleven of the remaining 12 were real bugs that duplicated known issues or other scan findings, and one was a false positive.

That is a strong result, but it is worth reading the boundaries carefully. The sample covers only critical and high-severity findings, not the full output distribution, and the reviewers are the same pen testers who work on Anthropic's disclosure pipeline rather than an independent party. Anthropic itself notes that maintainers have told it severity ratings can be inflated and that the scanner sometimes misunderstands a project's threat model — a failure mode that no false-positive rate captures, because the bug is real but the risk framing is wrong.

The maintainer quotes Anthropic published are positive and specific. wolfSSL's Todd Ouska says that of 74 reports received, all but two were valid and five became CVEs. OpenSSL Corporation's Anton Arapov says the reports, raw model output included, were as good as and sometimes better than human submissions, and that a report with a working exploit attached is close to finished work for an engineer. PostgreSQL's Noah Misch says several reports came with fixes usable nearly as-is. curl's Daniel Stenberg says the scanner found multiple issues worth addressing, including one of the worst curl vulnerabilities reported in recent years. HotCRP's Eddie Kohler describes the reports as thorough and well-prioritized.

Those are serious projects with serious security practices. They are also, by definition, the early testers — the ones with capacity to absorb a batch of machine-generated findings. Whether the experience generalizes to a thinly staffed project that suddenly receives a few hundred unverified reports is the open question, and it is exactly the scenario Anthropic says it wants to avoid by steering under-resourced projects toward the human-reviewed CVD track.

The capability curve behind it

Anthropic's justification rests on how fast model performance on vulnerability discovery has moved. On CyberGym, an academic benchmark the company cites, it says language models went from finding under 20% of vulnerabilities at the start of last year to over 85% this year. The company's framing is that maintainers have gone from receiving low-quality AI noise to receiving high-quality bug reports, and that because working exploits can now be produced in minutes, defenders need findings the moment they exist.

That argument is coherent and also uncomfortable, because it is symmetric. A capability that lets a vendor generate 29,000 candidate vulnerabilities in six months is not inherently defensive. Anthropic acknowledges the dual-use dimension indirectly by mentioning a new Cyber Verification Program that makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals — a gating mechanism whose criteria, scale and review process are not described in the announcement. The company also offers free Claude Max 20x subscriptions to open-source projects through a program called Claude for OSS.

There is a commercial layer here too. Anthropic positions Claude Security, its code scanning and patching product, as the enterprise offering, with OSS Scanner as the free version for open-source projects. Free security tooling for critical infrastructure is a genuine public good; it is also an unusually effective demonstration channel for the paid product, and a source of real-world signal on model performance. Both things can be true.

What the announcement does not say

Several operational details are absent. Anthropic does not disclose how frequently enrolled projects will be scanned, what volume of reports a project should expect, how embargo timing works for findings that arrive unvalidated, or what happens to code and findings after a scan. It does not say who makes eligibility decisions or how long enrollment review takes. It does not quantify the false-positive rate for medium- and low-severity findings, which is where volume and maintainer fatigue usually concentrate. Nor does it address what maintainers should do when a model-generated patch is plausible but subtly wrong — a review burden that does not disappear just because the patch arrived for free.

What to watch

• Whether the 88% figure holds at scale and across lower-severity findings once enrollment widens beyond the early cohort of well-resourced projects.
• How maintainers handle report volume: the signal to track is not validity rate but how many enrolled projects stay opted in after their first few batches.
• Whether an independent party ever audits OSS Scanner output, rather than Anthropic's own CVD reviewers.
• How the Cyber Verification Program defines a qualifying security professional, and whether reduced blocking classifiers become a target for misuse.
• Whether other frontier labs match the free-for-open-source model, and whether foundations and distributions start treating AI scan results as a standard input to release processes.