Anthropic launches free OSS Scanner for open-source projects

Anthropic says reports will include a reproducer, an explanation, information about when a bug was introduced when possible, and a candidate patch when available.[1] Its pipeline uses agents to double-check bugs, propose patches and perform root-cause analysis.[2] After an initial scan, Anthropic says it will regularly scan for potential new vulnerabilities and issues missed in earlier scans.[2] The schedule is not fixed: Anthropic says follow-up timing may depend on how many projects are in its pipeline and how widely the scanner is used.[2]

Core maintainers can enroll by submitting a pull request to Anthropic’s OSS Scanner GitHub repository.[2] Anthropic says eligible projects should have critical impact on infrastructure and user security, with decisions made case by case.[1] The service is intended for projects able to keep up with verified high- or critical-severity vulnerability reports.[2] Maintainers receive a bundle of bug reports by email, and can pause reports through a configuration field or opt out by removing their project from the repository.[2] This makes capacity to assess incoming reports an important consideration before applying.

Anthropic warns that reports are generated by models without human review or triage, so some findings may be incorrect or invalid.[1] It says it will not impose a 90-day coordinated-disclosure period on unvalidated scanner findings.[2] Anthropic says vulnerability reports are stored in an isolated cloud project accessible only to security staff who need them, and scanning agents run in hardened sandboxes without internet access.[2] Separately, Anthropic says it will continue manually disclosing human-verified vulnerabilities through its existing coordinated-disclosure process.[1]

Anthropic says scans over six months found more than 29,000 candidate vulnerabilities, of which it manually reviewed and triaged about 6,000.[1] It says it sent nearly 5,000 unvalidated reports to maintainers who requested all available findings.[1] Expert penetration testers assessed 97 critical- and high-severity findings across 48 projects; Anthropic says 85, or 88%, met its coordinated-vulnerability-disclosure standard.[1] Of the remaining 12, it says 11 were real but duplicates or overlapping findings, and one was invalid.[1] wolfSSL’s Todd Ouska said 72 of 74 reports it received were valid and five became CVEs.[1]