Anthropic Opens Free Claude Vuln Scanner to OSS Maintainers
TL;DR
- Claude improved from finding under 20% to over 85% of CyberGym benchmark vulnerabilities within one year, a step-change in AI offensive security capability.
- Only 584 of 6,157 disclosed vulnerabilities generated CVE or GitHub Security Advisory identifiers, leaving SCA tooling blind to the vast majority of AI-surfaced fixes.
- Anthropic omitted a 90-day disclosure deadline, departing from the coordinated vulnerability disclosure norms most security programs follow.
Penetration testers reviewed 97 high- and critical-severity findings produced by Anthropic's new OSS Scanner across 48 open-source projects, Help Net Security reports. Eighty-five cleared coordinated-disclosure criteria. Eleven were genuine but already known. One was invalid.
The service builds on an earlier internal effort called Project Glasswing and sends AI-generated vulnerability reports straight to maintainers with no prior human triage. Anthropic's own line about the trade-off is flat: "We can't guarantee the scanner will be perfect." Unvalidated findings do not carry a mandatory disclosure deadline unless Anthropic later validates them through its coordinated-disclosure program, which triggers a 90-day clock.
The pitch comes with an endorsement from Anton Arapov of OpenSSL Corporation: "Early AI reports about 18 months ago, before Project Glasswing, were appalling. The reports we received from Anthropic, raw model output included, were as good and sometimes better than what we get from people. Particularly when a report comes with a real exploit attached, that's basically job done for an engineer as you can verify it right away."
According to Anthropic's own announcement, the company has identified more than 29,000 candidate vulnerabilities in critical open-source projects and reported a little more than 6,000 to maintainers; it puts the scanner's success rate above 85%, up from under 20% early last year. Core maintainers of established, infrastructure-critical projects apply through the OSS Scanner GitHub repo and can pause or exit at any time.
The launch lands a day after our coverage of Anthropic's Cyber Mission with 11 founding partners, part of a wider run of Anthropic security moves on our tracker.
What others are reporting
-
Anthropic Research Blog Read →
First-party research post with benchmark trajectory data, 88% CVD accuracy on 97 tested findings, enrollment mechanics, and named partner testimonials absent from news coverage.
Projects that join will receive thorough, periodic security scans by our strongest models at no cost.
-
Anthropic Read →
First-party announcement naming all 11 CIDP partners and disclosing roadmap funding commitments to the Python Software Foundation and OpenSSF.
Frontier models can help find and repair weaknesses before those weaknesses are used to cut off power or make water unsafe.
-
The Hacker News Read →
Security trade framing: foregrounds the 584-advisory count against 29,000+ candidates and frames the absent 90-day deadline as a deliberate risk-acceptance posture.
Projects that join will receive thorough, periodic security scans by our strongest models at no cost.
-
Cybersecurity News Read →
Technical implementation details: network-isolated VMs during scans, Dockerfile enrollment requirements, and 6,000+ reports reviewed through prior channels before the scanner launched.
OSS Scanner uses the company's strongest AI models to run repeated scans, giving developers a faster route to potential flaws.
-
BERI Read →
Critical angle on SCA tooling blindness: patches shipping without CVE identifiers break automated patching workflows, compounded by NIST April 2026 CVE enrichment cutbacks.
Reports 'are model-generated and sent without human review' and may contain errors such as wrong severity ratings.
Originally reported by helpnetsecurity.com
Read the original article →Original headline: Anthropic Launches OSS Scanner Offering Free Claude-Powered Vuln Audits to Open-Source Maintainers