Anthropic launches free OSS Scanner to find open-source vulnerabilities using AI
Anthropic introduces a free vulnerability scanner for open-source code, leveraging AI to identify bugs and help maintainers fix them before exploitation.
Key points
- Anthropic discovered over 29,000 candidate vulnerabilities in widely used software during recent testing.
- The company has manually confirmed approximately 6,000 of these findings, citing human review as the primary bottleneck.
- Nearly 5,000 unverified reports with suggested fixes have been shared with maintainers who requested them.
Anthropic has launched OSS Scanner, a free vulnerability scanning tool designed to help open-source project maintainers identify and fix security flaws. According to Security Affairs, the service allows projects to join at no cost and uses artificial intelligence to detect bugs before attackers can exploit them.
The tool emerged directly from lessons learned during Project Glasswing, where Anthropic ran its Claude models against real-world targets. The company aims to accelerate the discovery and remediation of vulnerabilities in critical software infrastructure. By offering this service for free, Anthropic seeks to lower the barrier for maintainers to secure their codebases.
Context and Background
The launch coincides with a rapid improvement in the ability of large language models to find security flaws. On CyberGym, an academic benchmark for vulnerability detection, LLMs improved from catching under 20 percent of known flaws at the start of last year to over 85 percent this year. This represents a significant shift in the category of tools available for security analysis.
Over the past six months, Anthropic tested its latest AI models on some of the most widely used open-source software projects. The scans identified more than 29,000 possible vulnerabilities. However, Anthropic experts have only had time to manually check and confirm about 6,000 of these findings. This backlog highlights that the main limitation is not the AI's detection capability, but the time required for human verification.
Who Is Affected
Anthropic stated that it remains bottlenecked on human capacity to validate the large volume of findings. Because of this constraint, some maintainers requested that Anthropic send them all findings, including those that had not been confirmed by human reviewers. The company agreed to this approach for specific projects.
Anthropic has already shared nearly 5,000 unverified reports, along with suggested fixes, with maintainers who explicitly requested them. The company reasoned that waiting for human checks could create more risk than sending reports early, given that attackers can develop exploits in minutes. This model borrows loosely from Google’s OSS-Fuzz, which uses fuzzers, but OSS Scanner uses Anthropic’s strongest models, including Claude Mythos, in a fully automated process with no prior human review.
What should you do?
Maintainers of open-source projects should evaluate whether to accept unverified vulnerability reports from AI scanners. Developers should verify any incoming reports before applying fixes to avoid introducing new errors. Organizations relying on open-source components should monitor for updates from maintainers who may be processing these new findings.
Background: Large language models
Large language models are a specific type of neural network trained on text. Generative AI is the broader umbrella term for any system that creates new content, including images and code. Not all generative AI uses large language models, but most modern text generators do.
What to do and how to stay safe: Anthropic
- Review any vulnerability reports received from AI scanners carefully before applying suggested fixes to your code.
- Verify the validity of reported flaws through manual testing or additional static analysis tools.
- Monitor official project channels for confirmed patches and updates from maintainers.
- Ensure your build processes include security checks to catch potential regressions after applying fixes.
Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the OSS Scanner free to use?
Yes, Anthropic offers the OSS Scanner for free, allowing open-source projects to join the service at no cost.
How many vulnerabilities has Anthropic confirmed?
Anthropic has manually reviewed and triaged approximately 6,000 vulnerabilities out of more than 29,000 candidate findings discovered in the past six months.
Why are unverified reports being shared with maintainers?
Anthropic shared unverified reports because human review is a bottleneck, and delaying disclosure while waiting for checks may create more risk than sending early findings with verification warnings.
