Anthropic Launches OSS Scanner to Speed Up Open Source Vulnerability Fixes

Anthropic has released OSS Scanner, a free service that uses its Claude models to detect vulnerabilities in open source software. The platform provides maintainers with detailed reports and suggested patches, bypassing the traditional manual review bottleneck.

What happened

Anthropic introduced OSS Scanner to address delays in fixing open source vulnerabilities. The service uses Mythos and other Claude models to scan code and generate reports. Participating maintainers receive findings with reproduction instructions and proposed fixes immediately. This removes the wait for Anthropic’s researchers to validate each issue manually. The company previously found over 29,000 candidate vulnerabilities in six months but only reviewed 6,000. Some maintainers requested access to unreviewed findings for their projects. Anthropic has already sent nearly 5,000 such reports.

Why it matters

The delay between finding a flaw and patching it creates risk. Anthropic admitted that its previous efforts had not sufficiently reduced cyber risk. Months often passed between discovery and a fix, drawing criticism from security researchers. OSS Scanner aims to automate triage and help projects turn AI findings into patches faster. Early evaluations showed strong accuracy. Penetration testers examined 97 high- and critical-severity findings across 48 projects. Eighty-five met disclosure criteria, while eleven were duplicates and one was invalid.

What to watch

• Monitor whether the volume of unreviewed reports overwhelms maintainers who lack resources to investigate them.
• Watch for changes in how severity ratings are handled, as some maintainers have challenged inflated scores.
• Observe if the service expands beyond projects that already have capacity to handle high-severity reports.
• Track how many projects actually ship patches based on these AI-generated findings versus ignoring them.

Who needs to act first

Teams should prioritize updating systems that expose open source components to external networks. Evaluate whether your organization has the capacity to review unvalidated vulnerability reports before signing up. Ensure you have a process for testing proposed patches in a non-production environment first. Back up critical configurations before applying any automated fixes. Focus on projects that are already receiving verified high-severity reports, as they are better positioned to handle additional findings.

What to do and how to stay safe: Anthropic

• Review your open source dependencies to identify projects participating in the OSS Scanner program.
• Assess your team’s capacity to investigate unvalidated vulnerability reports before opting in.
• Establish a testing pipeline for AI-proposed patches to verify they do not break functionality.
• Monitor Anthropic’s disclosure dashboard for updates on patch rates and true-positive metrics.

Step-by-step guide: Virtual Patching Myths: What It Actually Fixes and Breaks

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is Anthropic’s OSS Scanner?

It is a free, opt-in service that uses Claude models to find vulnerabilities in open source projects and send maintainers reports with proposed fixes.

How accurate are the findings from OSS Scanner?

In an early test, 85 of 97 evaluated findings met Anthropic’s disclosure criteria, with eleven being duplicates and one invalid.

Does OSS Scanner replace manual security reviews?

No, it aims to help projects turn AI findings into fixes faster, but maintainers must still investigate and validate the reports.