Summary
Anthropic has launched OSS Scanner, an opt-in service that uses its language models to find vulnerabilities in eligible open-source projects at no cost. Reports are sent without human review, so maintainers receive findings faster but must assess them.
Anthropic announced OSS Scanner on October 8, 2026, an opt-in service that uses its language models to scan eligible open-source software for vulnerabilities. Projects accepted into the programme will receive periodic scans at no cost, with reports sent as soon as they are generated rather than waiting for human review and triage.
The service addresses a capacity problem Anthropic says it encountered while scanning software over the past six months: its models identified more than 29,000 candidate vulnerabilities, but the company’s team could manually review and triage only about 6,000. Anthropic says it has also sent nearly 5,000 unverified reports to maintainers who asked to receive its findings in bulk.
How the reports work—and what testing found
OSS Scanner’s reports are fully model-generated. Anthropic says they can include a self-contained reproducer—steps or inputs that help a maintainer trigger the reported bug—along with an explanation, an analysis of when the bug was introduced where possible, and a candidate patch when available. Sending reports without human triage is intended to make scanning faster and more frequent; it also means a report may be incorrect or overlap with a known issue.
Before opening the service to more projects, Anthropic says it asked expert penetration testers who review its coordinated vulnerability disclosures to assess 97 critical- and high-severity findings across 48 projects. The testers judged 85 findings, or 88%, as meeting the bar for Anthropic’s disclosure process. Of the other 12, Anthropic reports that 11 were real but duplicated known issues or other scan findings, and one was invalid.
That evaluation suggests the reports can be useful to security teams, while also showing why maintainers need to check them. Anthropic says some maintainers have found severity ratings inflated or felt the scanner misunderstood a project’s threat model. The evaluation concerns a selected set of high- and critical-severity findings, not every report the service may produce.
Who can enrol
Core maintainers can apply by submitting a pull request to an Anthropic GitHub repository using its project template. Eligibility follows criteria similar to OSS-Fuzz, the open-source vulnerability-scanning project that uses fuzzers: projects should have a critical impact on infrastructure and user security. Anthropic says applications will be assessed case by case.
The offer is distinct from Claude Security, which Anthropic describes as a general-access code-scanning and patching product focused on enterprises. OSS Scanner is specifically aimed at open-source projects. Anthropic says faster findings could help maintainers respond while attackers are also searching for exploitable weaknesses; its existing coordinated disclosure process will continue to handle reports that receive human verification.