The announcement
On October 8, 2026, Anthropic launched OSS Scanner, a free, opt-in service that uses its strongest models, including Claude Mythos, to look for vulnerabilities in open-source projects. Its stated inspiration is Google's OSS-Fuzz, which does the same with fuzzers.
The numbers
According to Anthropic, over the past six months its models found more than 29,000 candidate vulnerabilities in important software, but the team could manually review only about 6,000. Many maintainers asked to receive everything, even unreviewed: the company has sent nearly 5,000 such reports.
On the academic CyberGym benchmark, Anthropic says models went from finding under 20% of vulnerabilities at the start of last year to over 85% this year.
To validate the scanner, penetration testers reviewed 97 critical and high findings across 48 projects: 85 (88%) met the bar for its coordinated vulnerability disclosure (CVD) process, 11 were real but duplicates, and only 1 was a false positive.
Important: no human review
OSS Scanner reports are fully model-generated, with no human triage. That allows faster, more frequent scans, but Anthropic itself warns that some may be wrong or have inflated severity. Each report includes a reproducer, an explanation, a bisection of when the bug was introduced (where possible) and a candidate patch.
Anthropic says it will keep using its human-verified CVD process, especially for projects without the staff to triage reports.
What maintainers said
The page quotes PostgreSQL, OpenSSL, wolfSSL (74 reports, only 2 invalid, 5 became CVEs), HotCRP and curl. curl's Daniel Stenberg says it found "one of the worst curl vulnerabilities reported in the last few years."
How to join (GitHub repo)
Enrollment is by pull request to github.com/anthropics/oss-scanner (Apache-2.0), following the project template (project.yaml and, if needed, a Dockerfile to build the project). Only core maintainers can enroll, and eligibility follows criteria similar to OSS-Fuzz: critical impact on infrastructure and user security, decided case by case.
Same day: a critical infrastructure program
On the same date, Anthropic announced a critical infrastructure defense program with 11 industrial (OT) security partners, including Accenture, CrowdStrike, Dragos, Hitachi, Palo Alto Networks and Rockwell, according to SecurityWeek.
What it means for businesses
- Patches will arrive faster in popular libraries, and in higher volume. Automate dependency updates (Dependabot, Renovate) and follow security advisories.
- Attackers have the same tools. As Anthropic notes, exploits can now be built in minutes. The gap between patch and exploitation is shrinking.
- If you maintain a critical open-source project, consider enrolling, but budget time to triage unreviewed reports.
Sources
- Anthropic (Oct 8, 2026): https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source
- OSS Scanner page: https://red.anthropic.com/oss-scanner/
- Repository: https://github.com/anthropics/oss-scanner
- SecurityWeek: https://www.securityweek.com/anthropic-fast-tracks-ai-bug-reports-to-oss-maintainers-taps-11-firms-for-ot-security/
Want to get your company's dependency and patch management in order? KGA IT offers a free consultation: kga-it.com.