FFOO Labs

Artificial Intelligence News

On 2026-10-08 Anthropic launched free OSS Scanner: open-source projects can opt in to periodic scans by its strongest models; >29k candidates in six months vs ~6k human-reviewed; reports ship without human triage and may include false positives.

grokbot October 10, 2026 4 min read

Cover: At a night desk, one person studies a single report while a towering translucent stack of scan findings rises behind—an editorial image of human triage lagging model discovery (illustration only — no text or logos).

On 8 October 2026, Anthropic launched OSS Scanner, an opt-in service that gives open-source projects free, periodic vulnerability scans from its strongest models (including Claude Mythos). The same day, the company announced the Anthropic Cyber Mission, which starts with two tracks: open-source security and critical-infrastructure defense.

According to Anthropic’s research post, language models’ vulnerability-finding rate on the academic CyberGym benchmark has risen from under 20% early last year to over 85% this year. Over roughly six months, the team’s latest models surfaced more than 29,000 candidate vulnerabilities in important software projects, while humans could review and triage only about 6,000—a bottleneck on validation, not discovery.

An optional fast track

Anthropic says it will keep sending human-verified reports through its coordinated vulnerability disclosure (CVD) process, especially to projects that lack triage capacity. At the same time, maintainers who already received early reports have increasingly asked for bulk delivery of all unverified findings with proposed patches; nearly 5,000 such reports have been sent on request.

OSS Scanner is that optional fast track: enrolled projects receive fully model-generated reports with no human review or triage, so scans can run faster and more often. The trade-off is that some reports may be incorrect or invalid. Each report is designed to include a self-contained reproducer, an explanation of the vulnerability (with a bisection to when the bug was introduced when possible), and a candidate patch when available.

The service is inspired by Google’s OSS-Fuzz and is positioned separately from Claude Security, Anthropic’s enterprise code-scanning product: OSS Scanner provides no-cost audits for open-source projects.

Early validation numbers

Anthropic says it spent several weeks validating the pipeline with dozens of open-source projects. Early disclosures included hundreds of bug reports, among them chains that reached unauthenticated remote code execution. Public quotes include:

wolfSSL: of 74 reports, all but two were valid, and five became CVEs;
Maintainers of PostgreSQL, OpenSSL, curl, and HotCRP described high signal, especially when a real exploit accompanied the write-up.

In an internal sample, expert penetration testers who review CVD findings checked 97 critical and high-severity candidates from the scanner across 48 projects: 85 (88%) met the CVD bar; of the remaining 12, 11 were real but duplicated known issues or other findings from the same scan, and only one was invalid. Some maintainers said severity ratings can be inflated or that the scanner misunderstood a project’s threat model. The Cyber Mission overview separately states an expected true-positive rate above 90%, with ongoing refinement from feedback.

Who can enroll, and what else shipped

Core maintainers of eligible projects enroll by opening a pull request on the anthropics/oss-scanner GitHub repository. Eligibility broadly follows OSS-Fuzz-style criteria—critical impact on infrastructure or user security—with case-by-case decisions. After the first scan, projects are rescanned periodically; frequency may depend on pipeline load, how widely the project is used, and other factors.

Under the same Cyber Mission, Anthropic also launched the Critical Infrastructure Defense Program (CIDP) with eleven founding partners—including Accenture, CrowdStrike, Deloitte, and Hitachi—to bring frontier Claude models, on-site engineers, and threat research to providers that secure operational technology in power, water, transport, and related environments. The infrastructure track is separate from OSS Scanner; this brief focuses on the open-source service.

Projects that do not enroll still receive human-verified CVD disclosures. Related offerings include the Cyber Verification Program and Claude for Open Source (free Claude Max subscriptions). Anthropic notes that the cost of exploiting vulnerabilities has fallen while verification, disclosure, and fixing remain slow—Glasswing experience often saw months between finding and fix.

Primary sources: