Anthropic's OSS Scanner sends open-source maintainers free vulnerability reports that no human has reviewed

Anthropic opened a free vulnerability-scanning service for open-source projects on October 8, 2026. OSS Scanner runs periodic scans with the company's strongest models and sends the results straight to a project's maintainers. The trade-off is stated openly: reports arrive faster because no human reviews them first, so some of them will be wrong.

What maintainers receive

Each report contains a self-contained reproducer, a proof of concept that shows how the bug can be triggered. It also explains the vulnerability and includes a candidate patch when one is available. Where possible, the explanation includes a bisection that identifies when the bug entered the code. The scans run on Anthropic's strongest models, and the company names Claude Mythos among them.

Because the output is fully model-generated, Anthropic warns that some reports will contain mistakes, such as a wrong severity rating. Maintainers who tested early versions told the company that severity was sometimes inflated, or that the scanner misunderstood a project's threat model.

How accurate the reports are

Anthropic says it expects a true-positive rate above 90%, meaning more than nine in ten reported vulnerabilities should be real. Its own check of an early version came out slightly lower. Penetration testers reviewed 97 critical and high-severity findings across 48 projects, and 85 of them, or 88%, met the bar for Anthropic's coordinated disclosure process.

Of the remaining 12, the company says 11 were real but duplicated known issues or other findings, and only one was a false positive. The wolfSSL project, one of the early users, says all but two of the 74 reports it received were valid and that five became CVEs, entries in the public catalog of known vulnerabilities.

Who can enroll

Enrollment is open to core maintainers of eligible projects, who submit a pull request to Anthropic's oss-scanner repository on GitHub using a standard template. Eligibility follows criteria similar to those of Google's OSS-Fuzz. A project should have a critical impact on infrastructure and user security, and Anthropic decides case by case.

The service is meant for projects with the capacity to keep up with the findings. Projects without that capacity keep receiving human-verified reports through Anthropic's coordinated vulnerability disclosure process. Maintainers can also apply to Claude for OSS for free Claude Max 20x subscriptions.

Why Anthropic is doing this

The scanner grows out of Project Glasswing, Anthropic's program for finding vulnerabilities in critical software. Over the last six months, the company says, it found more than 29,000 candidate vulnerabilities but could manually review only about 6,000. Nearly 5,000 unverified reports have already gone to maintainers who asked for everything Anthropic had found.

OSS Scanner is part of the Anthropic Cyber Mission, announced the same day, which also introduced a Critical Infrastructure Defense Program for the providers that secure power, water, and transport systems. Anthropic says its Defender Advantage Fund keeps OSS Scanner free, but the posts do not give an amount.