Anthropic launches a free open source vulnerability scanner

Anthropic has launched OSS Scanner, a free service for regularly identifying vulnerabilities in open-source projects. The checks are performed using the company's powerful language models, including Claude Mythos.

The service operates on a principle similar to Google OSS-Fuzz, where artificial intelligence models are used instead of traditional fuzzers.

Participation is not available to all projects: selection is only for critical infrastructure security solutions. Maintainers submit applications via pull requests to the GitHub repository, and each application is reviewed individually.

Scan results include a working exploit reproducer with an explanation of the bug, a ready-made patch if it can be created, and information about the commit that introduced the error.

• A working exploit reproducer and detailed description of the vulnerability
• A ready-made patch to fix the discovered error
• Information about the commit in which the bug was introduced

There is an important nuance: reports are generated entirely by the model without human verification. Anthropic warns about possible false positives, but statistics show high effectiveness.

In six months of operation, the models detected more than 29,000 potential vulnerabilities. When checking 97 findings from 48 projects, 88% were real, with only one false positive recorded.

Scanning is performed in isolated sandboxes without internet access. The service does not replace the paid enterprise version of Claude Security.