Anthropic launches AI tool to scan open-source projects for security bugs

Automating security triage

Anthropic recently introduced OSS Scanner, a free service designed to find security vulnerabilities in open-source software. The tool uses the company's most capable models, including Claude Mythos, to analyze code and identify potential flaws. Unlike many security services, this tool is specifically designed for projects that form the backbone of digital infrastructure.

The primary goal of the scanner is to solve a bottleneck in the security industry. Anthropic's Frontier Red Team noted that human validation has become a significant constraint on the speed of security research. Over a six-month period, the company's models identified more than 29,000 candidate vulnerabilities, but researchers were only able to manually review and triage about 6,000 of them.

To address this, Anthropic decided to deliver unreviewed reports directly to project maintainers. This allows the community to receive information much faster than traditional methods. Maintainers who opted for early access received nearly 5,000 unverified reports along with proposed patches to help them prioritize their work.

How the scanner works

The scanner operates by analyzing code to find bugs and then generating a comprehensive report for the project's maintainers. Each report includes a self-contained reproducer, which is a piece of code that demonstrates the bug, and a detailed explanation of the suspected vulnerability. In many cases, the AI also identifies the specific change that introduced the bug through a process called bisection.

Beyond just finding the problem, the tool often supplies a candidate patch to fix the issue. The system uses agents to double-check bugs, propose these patches, and analyze the root causes before the final email is sent to the maintainers. This automated checking is distinct from human review, which Anthropic still offers for projects that lack the resources to handle raw data.

Maintainers can customize how the scanner behaves by providing a project configuration and a Dockerfile to prepare the build environment. They can also include an optional threat-model file. This document allows them to identify untrusted inputs, exclude specific components, and explain how they judge the severity of different types of threats.

Real-world impact and testing

Anthropic tested an early version of the scanner by asking penetration testers to assess 97 critical and high-severity findings across 48 different projects. Of those, 85 met the company's criteria for coordinated vulnerability disclosure. While some reports were duplicates or invalid, the results provided a baseline for the tool's performance on a specific sample rather than a general accuracy rate.

Several major projects have already seen results from the scanner. For example, a maintainer for the curl project attributed a high-severity vulnerability to an Anthropic employee using the scanner. This bug, which could allow remote code execution under certain conditions, was eventually fixed in curl version 8.23.0. Another maintainer for the wolfSSL project reported that nearly all of the 74 reports they received were valid.

Some maintainers have noted that the AI can occasionally produce inflated severity ratings or misunderstand specific threat models. However, others have found the raw reports to be as good as, or sometimes better than, reports received from humans. This is particularly true when a working exploit is provided, making it much easier for the maintainer to verify the issue quickly.

Adoption and limitations

The service is not open to everyone; Anthropic assesses enrollment requests on a case-by-case basis. They prioritize established projects that are important to infrastructure and user security. They also verify that the applicant is a core maintainer and that the findings will reach an authorized security contact. Projects have the flexibility to pause the reports or withdraw from the service at any time.

Because the reports are unverified, they do not carry an automatic 90-day disclosure deadline. This is a standard practice in the security industry to give maintainers time to fix a bug before it is made public. If a maintainer later validates a report manually, it can then enter a separate coordinated disclosure process with its own 90-day timeline.

Industry experts have pointed out that while automated patches are helpful, they are only part of the solution. Some argue that enterprises need to know if vulnerable code is actually reachable in their specific environments. Others suggest that the success of such tools should be measured by how much they reduce the workload for maintainers and how quickly a fix can be deployed to the public.

Comparison to other tools

Anthropic cites Google's OSS-Fuzz as a primary inspiration for this new service. However, while OSS-Fuzz uses fuzzing to find bugs, Anthropic's scanner uses language models to investigate the logic of the code. This allows the AI to perform more complex reasoning about how a program might behave in different scenarios.

The service also differs from other AI security tools like Google DeepMind's CodeMender. As reported by infoq.com, CodeMender retains human review before any patches are submitted upstream. In contrast, Anthropic's OSS Scanner is designed to deliver unreviewed findings directly to the maintainers to maximize the speed of information sharing.

Moving forward, Anthropic will continue to monitor project usage and its own workload to determine the frequency of scans. The goal is to identify newly introduced problems and issues that were missed in previous passes. By providing these tools for free, Anthropic aims to help secure the open-source ecosystem that many modern applications rely on.