Anthropic Introduces Free AI-Powered Security Scans for Open-Source Software

Image: Illustrative image · Прикли · CC0 · Source

Anthropic has launched OSS Scanner, a free opt-in service offering periodic AI-generated security scans to open-source projects, aiming to detect vulnerabilities faster despite lack of human review.

Anthropic, an AI research company, has announced OSS Scanner, a new free service designed to help open-source software projects identify security vulnerabilities using advanced language models. Open-source projects that opt into OSS Scanner will receive comprehensive, periodic vulnerability reports generated entirely by AI models including Anthropic’s most capable Claude Mythos, without human review or triage.

The goal of OSS Scanner is to provide maintainers earlier detection of potential security issues to improve software defenses. Anthropic’s experience with its Project Glasswing vulnerability discovery effort indicates that large language models (LLMs) have significantly improved in accurately finding software flaws, with successful detection rates increasing from below 20% to over 85% recently on vulnerability-finding benchmarks. Over the past six months, their models have uncovered more than 29,000 candidate vulnerabilities across major projects, though manual validation has so far covered only a fraction.

By automating the scanning process and delivering raw model-generated reports quickly, OSS Scanner enables more frequent audits of open-source code. However, the trade-off is that some findings may be false positives or incorrect due to the absence of human verification. To date, feedback from early adopters like PostgreSQL, OpenSSL, and wolfSSL has been positive, highlighting high validity and actionable patches accompanying many reports. Independent penetration testers also assessed a sample of critical reports, confirming an 88% acceptance rate under Anthropic’s coordinated vulnerability disclosure standards.

Each report produced by OSS Scanner includes a detailed explanation of the vulnerability, reproduction instructions, and when possible, a suggested patch. Anthropic expects this transparency to integrate smoothly into maintainers’ workflows, speeding remediation efforts amid an escalating threat landscape where exploits can be created rapidly.

Projects wishing to participate can enroll by submitting a pull request to a dedicated GitHub repository and must meet criteria similar to those of Google’s OSS-Fuzz program, focusing on software critical to infrastructure and user security. Anthropic also offers complementary tools such as free subscriptions to Claude Max 20x via its Cyber Verification Program, assisting security professionals with vulnerability remediation.

Although AI-powered vulnerability scanners are not new, Anthropic’s OSS Scanner emphasizes rapid delivery of high-quality automated reports to the open-source community at no cost. As language model capabilities evolve, this tool could become an important asset in defending widely-used software against emergent cyber threats.

Category: Apps Release Status: launched Release Date: null Product Name: OSS Scanner