Anthropic launches free scanner for open-source software: AI models reveal infrastructure vulnerabilities without human review

Anthropic launched the OSS Scanner service to periodically scan open-source software projects and discover their security vulnerabilities for free, relying entirely on its most advanced models, led by Claude Mythos, and without subjecting the generated reports to any prior human review or filtering before sending them to developers.

This step builds on a field experiment the company conducted through its earlier initiative known as Project Glasswing. In the past six months alone, Anthropic identified more than 29,000 potential security flaws in open-source code, but limited human resources allowed manual review of only about 6,000 of them. Faced with this gap, the service’s operators chose to bypass the human bottleneck, sending roughly 5,000 reports directly to project managers who requested everything the models had, even if it had not been previously verified.

Relying solely on automated generation raises the pace of security monitoring to unprecedented levels, but it also inevitably introduces a margin of false or erroneous reports. However, Anthropic’s internal accuracy assessment showed exceptional performance: among 97 critical and severe vulnerabilities examined by penetration-testing experts across 48 projects, 85 flaws (88 percent) fully met the coordinated detection criteria. Of the remaining twelve cases, eleven were genuine issues that matched known or previously discovered vulnerabilities, and only one false positive was recorded.

Executive reports include the code proof and a ready-to-apply patch for developers.Each report the service sends contains a self-contained exploit reproduction tool for the vulnerability, together with a detailed description of its nature that includes, where possible, the date the buggy code was introduced, as well as a candidate patch proposal when available. This composition has turned the relationship between generative models and open-source maintenance teams from vague alerts into concrete work items.

Testimonials from software leaders at the core of the global digital infrastructure reflected this qualitative shift. Anton Arabov of OpenSSL noted that AI-generated reports a year and a half ago were extremely poor, whereas the current reports from Anthropic, including raw model outputs, match what human experts provide and sometimes surpass it, especially when the report includes a real exploit that lets an engineer verify immediately. Todd Oskam of wolfSSL confirmed that his company received 74 security reports, all of which were valid except for two, and five of them turned into globally recognized CVE vulnerabilities, noting that attaching patch proposals made handling them smooth and integrated into established workflows. Daniel Stenberg, maintainer of the curl project, said the scanner helped his team detect extremely serious flaws, one of which ranks among the worst reported in the project in recent years, while Eddie Cole of the HotCRP platform praised the reports’ accuracy and their deep understanding of the complex permission model and priority ordering.

The software stack used by Gulf banks and digital institutions in Egypt and the Levant suddenly faces a new security phase that demands different auditing skills.Regional organizations rely heavily and almost entirely on open-source core software such as OpenSSL and curl to secure communication channels, electronic payments, and sovereign cloud networks. Shifting to automated scanning of these components with models like Claude Mythos means that the rate of vulnerability discovery and the flow of patch requests will accelerate at a pace local engineering teams have not experienced, making the competitive edge of technical departments dependent on their ability to quickly test and merge patches before the flaws are exploited in cyber-attacks, rather than relying on slow, spaced-out maintenance cycles.

Open-source project managers who wish to join the service can register by submitting a pull request to a dedicated repository on GitHub. The service integrates with Anthropic-announced supporting initiatives, including a cyber-verification program that provides advanced cyber capabilities and reduced ban classifications for qualified professionals, and the Claude open-source initiative that offers free Claude Max 20× subscriptions to help developers fix vulnerabilities and evolve their software.