Anthropic Offers Free AI Vulnerability Scans for Open-Source Projects

Anthropic has launched OSS Scanner, an opt-in vulnerability scanner for the open-source ecosystem. Projects that join will receive thorough, periodic security scans by its strongest models at no cost. The service builds on the company's experience using Claude to find vulnerabilities during Project Glasswing.

The company says AI has become much better at this work. On CyberGym, an academic benchmark, language models have gone from finding under 20% of vulnerabilities at the start of last year to over 85% this year. Anthropic says open-source maintainers have gone from receiving mostly low-quality AI reports to receiving high-quality bug reports. Over six months, its models flagged over 29,000 candidate vulnerabilities in important software projects, but the team has manually reviewed only about 6,000 of them, so human validation remains a bottleneck.

Some maintainers have asked for everything, even unverified reports with proposed patches, and Anthropic has sent nearly 5,000 such reports directly. It notes that exploits can now be developed in minutes, so projects that find and fix flaws faster are better placed against attackers racing to find the same weaknesses. Human-verified reports will still go through its existing coordinated vulnerability disclosure process, especially for projects lacking resources to triage reports. Projects can now also opt in to a fast-track for receiving reports as soon as they are available.