What is OSS Scanner?
Anthropic has launched OSS Scanner, a free vulnerability scanner for critical open-source projects that runs on the company's own infrastructure. It uses Anthropic's strongest models, including Claude Mythos. The program is opt-in: maintainers enroll by opening a pull request on GitHub.
How it works
Maintainers provide the repository and a Dockerfile path. Audits run in an isolated virtual machine with no internet access. Agents double-check bugs, perform root cause analysis and propose patches where possible. Each report includes a self-contained reproducer and an explanation of the bug; some include a bisection to the commit that introduced it.
Early results
- Eleven days after the October 8 launch, Anthropic reported 77 critical and 803 high model-rated findings.
- As of October 19, 114 projects had been accepted from about 650 applications.
- Anthropic's penetration testers reviewed 97 critical and high findings across 48 projects: 85 (88%) met the company's coordinated disclosure bar, 11 duplicated known issues, and 1 was invalid.
- wolfSSL said 72 of the 74 reports it received were valid; 5 became CVEs.
- curl patched CVE-2026-92392, a high-severity HTTP/2 upload use-after-free.
Criticism
The main debate is that reports reach maintainers without human review. That speeds up findings but shifts triage work onto project teams, and some maintainers say severity ratings are inflated.
