Anthropic Launches OSS Scanner, a Free AI Vulnerability Scanner

Why it matters

Anthropic has introduced the Anthropic OSS Scanner, a free, opt-in program that periodically audits critical open-source projects using its strongest models, including Claude Mythos. Maintainers enroll through a pull request and supply a Dockerfile; audits then run in an isolated virtual machine with no Internet access. Reports, which include a reproducer, root cause analysis, and a candidate patch where possible, go directly to maintainers without human review. The design borrows from Google's OSS-Fuzz but replaces fuzzers with language models. Anthropic says the program formalizes an earlier ad hoc arrangement in which models surfaced a large volume of candidate vulnerabilities that human reviewers could not fully triage. The company's internal audit found that most sampled critical and high findings met its coordinated vulnerability disclosure bar, with only a small number invalid or duplicating known issues, and wolfSSL independently validated nearly all reports it received. The trade-off is that triage burden shifts to maintainers, some of whom report inflated severity, and unvalidated findings face no fixed disclosure deadline.