Anthropic Launches OSS Scanner for Open-Source Security Checks
Anthropic introduced the free, opt-in OSS Scanner service, which is intended to periodically search for vulnerabilities in selected open-source projects.
On October 8, 2026, Anthropic launched Anthropic OSS Scanner, a free service for periodically searching for security vulnerabilities in selected open-source projects. The program operates on a voluntary opt-in basis, and Anthropic will decide on acceptance individually.
The service is intended for established projects that are critical to infrastructure or user security. It is therefore not an automatically available scanner for every public repository. Maintainers must apply and verify that they are authorized to represent the project.
How Anthropic OSS Scanner Works
After a project joins, the service is intended to perform regular security scans. Findings will be sent to the project maintainer as reports generated by Anthropic models. Importantly, these outputs do not undergo human review or triage by the company before delivery.
A report is supposed to include a reproduction of the issue, an explanation of the vulnerability and, when available, a proposed fix. The issue reproduction, often also referred to as a proof of concept, is intended to help maintainers verify whether the reported problem is real and under what conditions it can be exploited.
Anthropic says it will not publish unverified automated reports. Participating projects can also pause scanning or leave the service entirely.
Benefits and Workload for Maintainers
Open-source components form the foundation of much of the digital infrastructure used every day. If a report contains a usable reproduction of the issue and a precise description of the bug, it may shorten the time maintainers need to identify the problem and prepare a fix.
However, the chosen model shifts the verification of findings to individual project teams. Because the reports are not validated by humans, they may include a misjudged issue, overstated severity or a finding that does not correspond to the specific project’s security model.
Anthropic expects a true-positive rate above 90 percent. This is the company’s estimate and is not yet an independently verified result from the service’s operation. The company also claims that it found hundreds of bugs during the pilot phase, including chainable paths to unauthenticated remote code execution. The scope and severity of these findings have not been independently substantiated for individual projects.
What the Service’s Operation Will Show
For a practical assessment of Anthropic OSS Scanner, the most important data will include the number of accepted projects, report accuracy, the share of false positives and the quality of proposed fixes. Confirmations from project maintainers will also be relevant, such as released fixes, CVE records or GitHub Security Advisories associated with the service’s findings.
The future disclosure process for serious vulnerabilities also remains an open question. Anthropic currently states that it will not publish unverified reports, but specific rules on potential disclosure deadlines for confirmed critical findings will be important to maintainers and users of the affected software.
Sources
- Anthropic — Launching an opt-in vulnerability-finding service for open-source software – Confirms the launch of OSS Scanner on October 8, 2026, the free opt-in model, unverified model-generated reports and participation criteria.
- Anthropic — OSS Scanner – Documents the application process, verification of maintainer authorization, the option to pause or leave the service and the report-handling process.
- Anthropic — Introducing the Anthropic Cyber Mission – Places OSS Scanner within the broader Anthropic Cyber Mission initiative and states that reports contain a proof of concept, an explanation and a possible proposed fix.
- Axios — Exclusive: Anthropic's new plan to protect critical infrastructure – Independently confirms that Anthropic launched the free AI OSS Scanner service for open-source software as part of the new initiative.
Verified and updated: 10/09/2026 15:21
