Anthropic Launches Free AI Vulnerability Scanner For Open-Source Projects

Anthropic has launched OSS Scanner, a free, opt-in AI-powered vulnerability scanner designed to help open-source developers identify security weaknesses before attackers can exploit them. The service uses the company’s most advanced artificial intelligence models, including Claude Mythos, to conduct periodic security scans and deliver reports directly to participating project maintainers.

The launch comes as AI tools become increasingly capable of detecting software vulnerabilities, creating new opportunities for cybersecurity teams while raising concerns about how quickly attackers could exploit similar capabilities. Although OSS Scanner aims to help developers identify flaws sooner, its reports are generated entirely by AI without human review or verification.

How Anthropic’s OSS Scanner Works

Inspired by Google’s OSS-Fuzz, which helps identify vulnerabilities through automated software testing, OSS Scanner provides security scans to eligible open-source projects at no cost.

Participating developers can receive reports containing explanations of potential vulnerabilities, reproducible examples to help verify findings, information about when bugs may have been introduced and proposed patches where available. This could help maintainers investigate weaknesses and release fixes before they are exploited.

The service builds on Anthropic’s experience using AI to identify software vulnerabilities through Project Glasswing. Over the past six months, the company said its models have identified more than 29,000 potential vulnerabilities across important software projects. However, its teams have only been able to manually review and triage around 6,000 findings, highlighting the difficulty of verifying security reports at scale.

OSS Scanner aims to reduce this bottleneck by allowing developers to receive potential vulnerability reports as soon as they are generated, rather than waiting for manual verification.

AI Reports May Still Contain Errors

Despite the benefits of faster scanning, Anthropic acknowledges that reports generated without human review may be inaccurate, duplicate known vulnerabilities or misinterpret a project’s security requirements.

To evaluate an early version of OSS Scanner, the company asked specialist penetration testers to examine 97 critical- and high-severity findings across 48 projects. Anthropic reported that 85 findings, or approximately 88%, met its standards for its coordinated vulnerability disclosure (CVD) process.

Of the remaining 12 findings, 11 involved genuine issues that duplicated known vulnerabilities or other findings, while only one was considered invalid. Although the results suggest that the scanner can produce useful reports, they do not guarantee that every future finding will be accurate.

Anthropic said it would continue improving the system based on feedback from maintainers. It also acknowledged that severity ratings can sometimes be overstated or that reports may not account for a project’s specific security model.

The company will maintain its existing CVD process, through which vulnerabilities are manually verified before disclosure. For OSS Scanner’s initial unverified reports, Anthropic does not intend to impose a standard 90-day disclosure deadline. However, if a finding is subsequently verified by a human through its CVD programme, the company may apply its disclosure policy from the date the maintainer is notified of that verification.

Cryptocurrency Projects Among Early Applicants

Interest in OSS Scanner has extended to cryptocurrency projects, where vulnerabilities can potentially expose user funds or disrupt essential network operations.

Early applicants included Nethermind, an Ethereum client developer, and ZEUS, a self-custodial Bitcoin and Lightning wallet. VirtEngine, a decentralised cloud computing marketplace built on the Cosmos SDK, also submitted an application.

These projects highlight how AI-assisted security scanning could help protect software responsible for processing blockchain transactions, managing private keys and supporting cryptocurrency payments. However, submitting an application does not guarantee acceptance, as Anthropic evaluates projects individually.

Its selection criteria consider factors such as a project’s importance to infrastructure and user security, exposure to remote attacks, and the number of users or downstream projects that depend on it.

Interest also extends beyond cryptocurrency, with developers working on AI assistants, machine-learning infrastructure, cloud storage, software development tools and energy-related systems among the wider applicant pool.

How Open-Source Developers Can Apply

Core maintainers of eligible projects can apply by submitting a pull request to the OSS Scanner GitHub repository using the required project template.

Applicants must provide their repository link, an email address for the primary contact and a path to a Dockerfile that prepares the project’s environment, installs dependencies and builds the software. This enables the AI agent to conduct its security audit within a prepared container without internet access.

Optional information includes additional email contacts, a project website, a public GPG key for encrypting report emails and a threat model outlining which parts of the code should be tested and how vulnerabilities should be classified.

Not every project will qualify. Anthropic said its selection criteria are similar to those used by OSS-Fuzz, prioritising projects with a critical impact on infrastructure and user security.

Anthropic Expands Its Cybersecurity Efforts

OSS Scanner is part of Anthropic’s broader cybersecurity initiatives, alongside Project Glasswing and its Critical Infrastructure Defense Program, which aims to support organisations protecting essential systems.

The company has warned that AI could make it cheaper and faster for attackers to discover vulnerabilities, develop exploits and conduct cyber operations. This creates pressure on developers to identify and fix weaknesses before they can be used against their software.

Anthropic believes that continued advances in AI could eventually make it easier to detect bugs before software is released, build more secure systems from the outset and strengthen active cyber defence.

For open-source maintainers, OSS Scanner offers an additional way to identify potential vulnerabilities without paying for security scans. Its long-term value, however, will depend on the accuracy of its reports and how quickly developers can verify findings and implement fixes.

As AI continues to reshape cybersecurity, faster vulnerability detection could give defenders a valuable advantage. Human oversight and careful verification will nevertheless remain essential to ensuring that security issues are addressed accurately and responsibly.

*Sources: Visual and Reference Credits to Social Media & various cross-references for context.

FOMO much? Follow our Facebook and Instagram for more updates.