Anthropic Wants to Make Open-Source Security Smarter

Securing open-source software is hard, and OSS Scanner is Anthropic’s attempt to make that job a little easier. Almost every app, website, and cloud service depends on open-source code. Much of it is maintained by small teams or volunteers with no dedicated security staff.

On October 8, 2026, Anthropic announced OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects. Maintainers must enroll, and not every repository qualifies.

This matters because finding bugs is no longer the hardest part. Anthropic’s launch post says it is bottlenecked on human capacity to validate findings. Below, we cover how OSS Scanner works, how to enroll, where it falls short, and what it means for developers and students. We will not claim AI replaces security engineers, because the evidence points the other way.

What Is OSS Scanner?

OSS Scanner is an Anthropic service that scans open-source repositories for security vulnerabilities and emails the results to maintainers. OSS Scanner is opt-in. Nothing is scanned unless a project’s core maintainers sign up.

It launched under the Anthropic Cyber Mission, a long-term effort announced the same day to support defenders. The mission starts with two areas: critical infrastructure and open-source software. OSS Scanner is the open-source piece, and Anthropic says it was inspired by Google’s OSS-Fuzz.

OSS Scanner also grows out of Project Glasswing, covered later in this article. During that work, some maintainers asked Anthropic for everything its models had found, reviewed or not. OSS Scanner is the fast track for those projects. Reports come from Anthropic’s strongest models, including Claude Mythos, and Anthropic pays for the compute. According to the Cyber Mission post, the Defender Advantage Fund (0xDAF) keeps the service free.

Who is OSS Scanner for? Established projects with a critical impact on infrastructure and user security. Anthropic adds that it suits projects already able to keep up with verified high and critical reports.

How does it differ from an ordinary code assistant? An assistant waits for you to ask about your code. OSS Scanner is a pipeline. It builds your project in a sandbox, audits it without anyone prompting it, and repeats the work periodically. OSS Scanner also differs from Claude Security, which is Anthropic’s commercial product for enterprises.

How Does OSS Scanner Work?

Anthropic’s GitHub repository describes the workflow. The sequence:

1. A core maintainer opens an enrollment pull request. Anthropic manually checks that the person really is a core maintainer.
2. The pull request supplies the repository address, a contact email, and build instructions.
3. Anthropic builds the project inside an isolated virtual machine.
4. The VM then moves to a network with no internet access, and scanning happens there.
5. AI models analyze the code for potential vulnerabilities. Anthropic says the pipeline also uses agents to double-check bugs, propose patches, and trace root causes.
6. The service produces findings with reproduction details.
7. Reports arrive by private email at the designated contacts.
8. Maintainers decide which findings are real and which fixes to ship.

Three files drive OSS Scanner. The project.yaml file holds the settings: repository, contact address, and optional extras. The Dockerfile installs every dependency and builds the project, because the audit later runs offline. The optional threat_model.md tells the scanner what matters. It can say which inputs are adversarial, what is out of scope, and how you rate severity.

One caveat matters. Anthropic states it cannot guarantee that every finding is correct, and patches are only candidates. Public documentation does not detail the scanner’s internals, so we will not guess.

What Makes OSS Scanner Different?

Several features set OSS Scanner apart from a one-off scan.

AI-Powered Vulnerability Discovery

Language models can read source code, follow how data moves through it, and flag logic that looks wrong. That is different from matching known patterns. HotCRP’s maintainer reported that the scanner showed a good grasp of the project’s complicated permission model.

On the academic CyberGym benchmark, Anthropic says LLMs went from finding under 20% of vulnerabilities early last year to over 85% this year. That is a benchmark result, not a promise for any single scan.

Periodic Scanning

Code changes constantly. After the first scan, enrolled projects are rescanned to catch newly introduced bugs and ones missed earlier. Anthropic says frequency may depend on how many projects are in the pipeline and how widely a project is used.

Detailed Vulnerability Reports

Each report includes a self-contained reproducer, an explanation, and a candidate patch when one is available. Where possible, it also includes a bisection showing when the bug was introduced. A reproducer lets maintainers check the claim directly.

Free Access for Eligible Projects

Small projects rarely afford a professional audit. Free scanning removes the cost barrier, though not the time needed to read and fix reports.

Experimental Analysis Techniques

Anthropic says it uses a variety of harnesses and techniques, including token-hungry and experimental ones meant to find deeper bugs. It does not publish the details, so the practical takeaway is simple: OSS Scanner may spend more compute per project than a typical assistant session.

The Role of Claude Mythos and Project Glasswing

Anthropic announced Project Glasswing on April 7, 2026, with partners including AWS, Apple, Google, Microsoft, and the Linux Foundation. It gave them access to Claude Mythos Preview to find and fix vulnerabilities in critical software. Anthropic reported thousands of high-severity vulnerabilities, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug.

The lesson Anthropic took from it is blunt. In the Cyber Mission post, it says finding vulnerabilities is easier than ever, but verifying, prioritizing, and fixing them remains hard. Over six months, its scans surfaced over 29,000 candidate vulnerabilities. Humans reviewed only about 6,000, and nearly 5,000 unvalidated reports went to maintainers who asked for everything.

That gap between finding and verifying explains why OSS Scanner exists.

Glasswing’s headline results came from Mythos Preview and its partners. They are not OSS Scanner results. The CyberGym score Anthropic published for Mythos Preview was 83.1%, against 66.6% for Claude Opus 4.6. CyberGym measures vulnerability reproduction, and these are Anthropic’s own reported figures.

OSS Scanner’s own evidence is smaller. Anthropic had expert penetration testers check 97 critical and high-severity findings across 48 projects. Of those, 85 (88%) met the bar for its disclosure process. Eleven of the other 12 were real but duplicates, and one was a false positive. Separately, Anthropic says it expects a true-positive rate above 90%. These figures measure different things, and neither is an independent audit.

On disclosure, human-verified findings still go through Anthropic’s coordinated vulnerability disclosure process. Raw OSS Scanner reports skip that review, so Anthropic places no 90-day disclosure clock on them.

How Open-Source Maintainers Can Enroll in OSS Scanner

Enrollment is meant for authorized core maintainers and is subject to Anthropic’s review and terms. Here is the path, based on the official GitHub repository:

1. Check eligibility. Anthropic uses criteria similar to OSS-Fuzz: critical infrastructure impact, exposure to remote attacks, and how many users or projects depend on you. Decisions are case by case.
2. Open the repository. Visit github.com/anthropics/oss-scanner.
3. Create the directory. Add projects/<name> in a pull request.
4. Configure project.yaml. Start from the template in templates/project.yaml.
5. Provide a Dockerfile. Keep it in your own repo, or place it next to project.yaml.
6. Add a threat model (optional). Anthropic strongly recommends it, especially your severity rules.
7. Validate. Run tools/validate.py, then tools/check <name> to build the project offline the way the scanner will.
8. Open the pull request. Anthropic reviews and merges enrollment requests only.
9. Receive findings. Reports go to your primary_contact and any CCs. You can add a PGP key for encrypted email, but then CCs are not allowed.
10. Pause or withdraw. Set disabled: true, or delete your project directory.

Every value below is a placeholder:

yaml

repo: https://github.com/YOUR-ORG/YOUR-PROJECT   # required
primary_contact: security@your-project.example    # required, publicly visible
auto_ccs:
  - maintainer@your-project.example               # optional
homepage: https://your-project.example            # optional
dockerfile: .oss-scanner/Dockerfile               # required unless Dockerfile sits beside project.yaml
threat_model: .oss-scanner/threat_model.md        # optional
disabled: false                                   # true pauses reports

The email addresses in project.yaml are public, so use a security alias. Also, Anthropic’s FAQ page writes the Dockerfile field with a capital D, while the repository template uses lowercase dockerfile. Follow the template and let tools/validate.py confirm.

OSS Scanner vs Traditional Security Tools

OSS Scanner is best compared conceptually. Each approach finds a different kind of problem.

SAST (static application security testing) scans source code without running it. It is fast and fits into CI, but it can bury teams in false positives and miss flaws that depend on application logic.

DAST (dynamic testing) attacks a running application from outside. It finds issues visible at runtime, such as misconfigurations, but only in the paths it manages to reach.

SCA (software composition analysis) checks your dependencies against databases of known vulnerabilities. It is vital for supply-chain hygiene, but it cannot find new bugs in your own code.

Fuzzing feeds unexpected inputs to a program and watches for crashes. It is strong against parsers and memory bugs, but it needs good harnesses and only covers what the inputs reach. Google’s OSS-Fuzz runs this approach for open-source projects.

AI-assisted analysis reads code, reasons about it, and tries to build working reproducers. Its limits are the ones covered next: invalid reports, inflated severity, and misread security boundaries.

Anthropic points to one case where automated testing hit a vulnerable FFmpeg line five million times without catching the bug. That is one anecdote, not a head-to-head comparison. There is no independent evidence yet that OSS Scanner outperforms these tools. The sensible view is that it complements them. Keep your fuzzers, dependency checks, and code review.

Limitations and Security Concerns of OSS Scanner

Some OSS Scanner limits are confirmed by Anthropic. Others are reasonable risks.

AI-Generated Reports Without Human Review

Confirmed: OSS Scanner output is fully model-generated, with no human review or triage. Anthropic says reports may be incorrect or invalid. Maintainers have told it that severity ratings can be inflated.

Maintainer Workload

Risk: speed cuts both ways. Anthropic admits many projects are already overwhelmed by reports, which is why it says the service is for teams that can keep up. A small team that enrolls too early could face a pile of findings it cannot triage.

Verification Requirements

Confirmed: patches are candidates. Reproduce every bug yourself, then test the fix against your own suite before merging. A reproducer makes this easier, but it does not replace judgment.

Context and Threat Models

Confirmed: some maintainers said OSS Scanner misunderstood their threat model. A scanner may call something critical that your design deliberately allows. This is why the optional threat_model.md is worth writing.

Sensitive Vulnerability Information

Anthropic says reports are held in an isolated, locked-down cloud project, and scanning agents run in hardened sandboxes with internet access disabled. Reports contain exploit details, so treat them like any embargoed bug: limit who sees them, and consider PGP. That advice is general practice, not a documented Anthropic incident.

What OSS Scanner Means for Developers and Students

Open-source contributors and maintainers gain a free second pair of eyes. The real work is triage, which is a skill worth building.

Backend developers and DevOps engineers can learn from the setup itself. Building a project offline in a container is a good test of whether your build is reproducible. The tools/check command exists for that.

Security teams can treat OSS Scanner reports as leads to verify, in the same queue as findings from other tools.

Students and cybersecurity learners should not assume a personal repository qualifies. Eligibility favors established projects with real infrastructure impact. The sources mention no regional restriction, but students in India or elsewhere should read the terms before planning around it.

You can still learn the underlying skills. Write a threat model for a small project. Practice reading code for unsafe input handling and reproducing a bug from a written description. Study how disclosure works. If you are building AI-powered tools yourself, our guide to Full-Stack AI development covers the application side, and When AI Agents Go Rogue covers the risks of autonomy.

The Future of AI-Powered Cybersecurity

Start with what is confirmed today. OSS Scanner delivers model-generated reports with reproducers and candidate patches, periodic rescans, and private email delivery. Claude for OSS also offers free Max subscriptions to maintainers.

Now the possibilities. Anthropic says it aims to bring OSS Scanner to more projects, automate triage and patching for projects that want it, and research safer ways to write code. These are stated goals, not shipped features.

Anthropic forecasts that AI may favor defenders in about two years, but not necessarily sooner, because exploiting bugs got cheaper while verifying and fixing them still depends on people. That is a forecast, not a fact.

Trust will decide how this plays out. Maintainers need reports they can check quickly, which is why reproducers and attribution IDs matter. Anthropic asks, but does not require, that fixes credit the report ID so it can track which findings were right. Nobody should expect AI to eliminate software vulnerabilities. A realistic goal is shorter gaps between discovery and a fix.

For a refresher on how models handle context, see our explainer on tokens in large language models.

OSS Scanner FAQ

Is OSS Scanner free? Yes, for accepted projects. Anthropic covers the cost.

Can I scan my own repository? Only if you are a core maintainer and the project qualifies. Anthropic decides case by case.

Does a human review the reports? No. Reports are model-generated and unreviewed, so verify each one.

Are the findings made public? Anthropic says it will not publish them and places no 90-day period on unvalidated findings. If it later validates one manually, it may disclose it under its coordinated process, starting 90 days after you are notified.

How do I stop receiving reports? Set disabled: true in your config, or delete your project directory in a pull request.

Conclusion

OSS Scanner offers something small projects rarely get: frequent, free analysis from advanced models, with reproducers attached. For maintainers who can handle the volume, that could shorten the time between a bug existing and a bug being fixed.

The costs are real too. Reports are unreviewed, severity can be inflated, and a scanner can misread a project’s security boundaries. Maintainer time remains the scarce resource.

So the value of OSS Scanner will not be measured by how many vulnerabilities it finds. It will be measured by how quickly developers can verify and fix them. If you maintain an eligible project, read the official FAQ and decide whether your team has the capacity.