Anthropic launches free opt-in OSS Scanner for open-source vulnerability hunting

On 8 October 2026, Anthropic launched a free, opt-in OSS Scanner for open-source projects, distinct from its enterprise Claude Security product and inspired by Google’s OSS-Fuzz.

How it works

• Enrolled projects get periodic scans by Anthropic’s strongest models, including Claude Mythos.
• Reports are model-generated without human review and may be incorrect.
• Typical reports include a reproducer, explanation and a candidate patch.
• Enrollment is via a pull request to Anthropic’s GitHub repo; eligibility is similar to OSS-Fuzz (critical infrastructure impact).
• Anthropic also offers Claude for OSS free Max 20x for remediation help.

Track record cited

• From Project Glasswing, Anthropic says models found more than 29,000 candidate vulnerabilities over about six months; roughly 6,000 were manually reviewed and about 5,000 reports went to maintainers who asked for bulk delivery.
• On the CyberGym benchmark, LLMs rose from finding under 20% of vulnerabilities early last year to over 85% this year, Anthropic reports.
• In early validation, experts reviewed 97 critical or high findings across 48 projects: 85 (88%) met the coordinated vulnerability disclosure bar; 11 were real but duplicate or already known; 1 was a false positive.

Maintainer feedback quoted by Anthropic includes PostgreSQL’s Noah Misch, OpenSSL’s Anton Arapov, and wolfSSL’s Todd Ouska (who said 74 reports arrived, all but two valid, yielding five CVEs).