Anthropic scans open-source projects for vulnerabilities for free

The AI provider Anthropic has introduced a free service for searching for vulnerabilities in open-source software. The so-called OSS Scanner is intended to regularly examine participating projects with the most powerful Claude models – including Claude Mythos.

As Anthropic explains in its announcement, the models generate the reports automatically – without human review or triage. This enables faster and more frequent scans, but also means that reports can be erroneous or invalid, according to the company. The check whether a finding actually represents a security vulnerability must therefore be carried out by the respective project. In a test run, 85 out of 97 findings were real, new security vulnerabilities, Anthropic reports. The rest were duplicates, previously known cases, or false alarms.

Unlike other security programs from Anthropic, the OSS Scanner is exclusively aimed at open-source projects.

Bottleneck: Human Review

According to Anthropic, the service originated from experiences with other security programs such as Project Glasswing. In the six months prior to the announcement, Anthropic states it examined software projects and found more than 29,000 potential vulnerabilities. However, it was only able to manually review around 6,000 of them. This is a current bottleneck, the company says. Almost 5,000 further unreviewed reports were therefore sent directly to maintainers at their express request – sometimes along with suggested patches. The company now wants to expand this procedure, according to Anthropic.

Interested open-source projects can likely reach out to Anthropic via GitHub.

(rie)