Anthropic launches automated security scanner for open-source projects

Bypassing the human bottleneck

Anthropic has introduced OSS Scanner, a free and opt-in service designed to find security vulnerabilities in open-source projects. The service uses the company's most capable models, including Claude Mythos, to scan code and generate security reports. These reports are sent directly to project maintainers without undergoing a human review by Anthropic first.

The company decided on this automated approach because human validation became a significant constraint during testing. Over a six-month period, Anthropic's models identified more than 29,000 candidate vulnerabilities, but researchers were only able to manually review and triage approximately 6,000 of them. This gap highlights the difficulty of scaling human oversight to keep up with AI-driven discovery.

Maintainers who wanted faster access previously received nearly 5,000 unverified reports along with proposed patches after requesting them. By moving to a direct delivery model, Anthropic aims to provide a higher volume of data to the community. Maintainers are responsible for validating the findings and deciding which proposed fixes to accept into their projects.

How the scanner works

Each report generated by the OSS Scanner includes a self-contained reproducer and a detailed explanation of the suspected vulnerability. When possible, the AI identifies the specific change that introduced the bug using a process called bisection. It also supplies a candidate patch that the maintainer can test immediately.

The system uses specialized agents to double-check bugs, propose patches, and analyze root causes before an email is sent. This automated checking is distinct from human review, which Anthropic still offers for projects that lack the resources to handle raw findings. The scanner also performs subsequent runs to look for newly introduced problems or issues that were missed in previous scans.

To enroll, core maintainers submit a GitHub pull request containing project configuration and a Dockerfile to prepare the build environment. The scanning process runs without internet access after the initial setup is complete. Maintainers can also provide an optional threat-model file to document the scope, identify untrusted inputs, and explain how they judge the severity of different issues.

Real-world testing and results

Anthropic tested an early version of the scanner by asking penetration testers to assess 97 critical and high-severity findings across 48 projects. Of those, 85 met the company's criteria for coordinated vulnerability disclosure. While some findings were duplicates or invalid, the results provided a snapshot of the tool's performance rather than a definitive accuracy rate for all future reports.

Feedback from the community has been mixed but generally positive regarding the quality of the raw data. For example, a maintainer for wolfSSL reported that of 74 reports received, all but two were valid, with five becoming CVEs. Another maintainer for OpenSSL described the raw reports as being as good as, or sometimes better than, reports received from humans, especially when a working exploit made verification easy.

However, some maintainers have noted issues with inflated severity ratings or misunderstandings of the specific threat models surrounding their projects. Anthropic acknowledges these discrepancies and allows maintainers to use the threat-model document to set expectations. This documentation helps the AI understand which components are most sensitive and which should be excluded from the scanning process.

Impact on the security pipeline

The launch of OSS Scanner represents a shift toward automated patch validation in the open-source ecosystem. It draws inspiration from Google's OSS-Fuzz but differs by delivering unreviewed findings directly to the upstream project. This contrasts with other tools like CodeMender, which retain human review before submitting any patches to the community.

Security experts have noted that providing an upstream patch is only half the battle for many organizations. Some argue that enterprises still need to determine if vulnerable code is reachable and if a fix can be applied without breaking existing applications. The success of the tool may depend on how well maintainers can integrate these automated reports into their existing workflows.

Anthropic continues to manually check enrollment requests to ensure that findings reach authorized security contacts. Projects have the flexibility to pause reports or withdraw from the service at any time. While unvalidated findings do not have an automatic 90-day disclosure deadline, any report that is later validated manually will enter a coordinated disclosure process with a standard 90-day window.

Who is eligible to join

Anthropic is currently assessing enrollment requests on a case-by-case basis to ensure the tool is used effectively. Priority is given to established projects that are important to infrastructure and user security. The company specifically looks for projects that already have the capacity to handle verified high-severity reports.

Maintainers can specify their preferred report formats and patch expectations within the enrollment process. This allows the AI to tailor its output to the specific needs of the project's development team. By allowing maintainers to define these parameters, Anthropic hopes to reduce the noise and increase the utility of the automated reports.

The company remains committed to supporting projects that do not have the resources to triage raw findings. For these smaller projects, Anthropic continues to offer human-reviewed disclosures. This tiered approach ensures that the tool serves as a high-volume pipeline for capable maintainers while still providing a safety net for smaller community efforts.