Anthropic launches free OSS Scanner with opt-in, unreviewed vulnerability reports
Anthropic has launched OSS Scanner, providing free periodic vulnerability scans to eligible open-source projects that opt in. Its fast-track reports are model-generated and receive no human review or triage.
The company says scans use its strongest models, including Claude Mythos. Reports include a self-contained reproducer, an explanation and a candidate patch when available. Skipping human validation reduces waiting, but reports may be invalid, duplicate known issues or overstate severity.
Core maintainers apply through a pull request to the official GitHub repository, supplying project configuration and a buildable Docker environment. Anthropic manually verifies maintainer status and assesses projects individually based on factors such as infrastructure and user-security impact. The service is aimed at teams already able to handle verified high-severity reports and seeking additional scanning.
The official FAQ says unvalidated reports currently carry no mandatory 90-day disclosure deadline. If a report is later human-validated, the existing coordinated disclosure process may start a 90-day period when maintainers are notified of that validation. Maintainers can pause through configuration or remove their project to opt out; the existing human-validated reporting process can still send them findings.
Sources
- Launching an opt-in vulnerability-finding service for open-source software — Anthropic：Research（发表成果 · 网页）
- OSS Scanner — red.anthropic.com