Anthropic just gave open-source maintainers something money can’t usually buy: recurring vulnerability scans from its most powerful models, free. The new Anthropic OSS Scanner finds real bugs — and sends raw AI-generated reports straight to maintainers, with no human review in between.
Announced October 8, 2026, the opt-in service uses Anthropic’s strongest models, including Claude Mythos, to hunt flaws in enrolled projects. Early results are striking: one cryptography library got 74 reports, all but two valid, and five became official CVEs.
What OSS Scanner actually does
Anthropic built OSS Scanner on Project Glasswing, its internal program using Claude to find vulnerabilities. The idea: give open-source projects the same scanning firepower, free, on a recurring basis.
- Free and opt-in: eligible projects enroll; Anthropic covers the full cost.
- Frontier models: reports come from Anthropic’s strongest models, including Claude Mythos.
- Fast, unreviewed delivery: reports are “fully model-generated, without human review or triage” — fast, but some may be wrong.
- Actionable reports: each includes a reproducer, an explanation (with a bisection to the bug’s introduction, where possible), and a candidate patch when available.
The scale is worth pausing on: Anthropic’s models surfaced over 29,000 candidate vulnerabilities in six months, but humans could review only ~6,000. The scanner answers that bottleneck.
The numbers that matter
Anthropic validated the pipeline first; the scorecard:
| Metric | Result | Source |
|---|---|---|
| Candidate vulnerabilities found (6 months) | 29,000+ | Anthropic |
| Manually reviewed and triaged | ~6,000 | Anthropic |
| Unverified reports sent to maintainers on request | ~5,000 | Anthropic |
| Critical/high findings passing the disclosure bar | 85 of 97 (88%) across 48 projects | Independent pen testers |
| False positives in that sample | 1 of 97 | Independent pen testers |
| wolfSSL reports / valid / became CVEs | 74 / 72 / 5 | Todd Ouska, wolfSSL, via Anthropic |
On CyberGym, an academic vulnerability benchmark, models went from finding under 20% of known vulnerabilities early last year to over 85% this year, Anthropic reports. That curve is why this is launching now.
Maintainer reactions are unusually warm. A PostgreSQL maintainer said an “unusually high fraction” of findings were real defects, with fixes usable nearly as-is. Daniel Stenberg of curl said the scanner found “one of the worst curl vulnerabilities reported in the last few years.”
How OSS Scanner works, step by step
How to profit: the developer playbook
Free enterprise-grade scanning opens real money-making doors.
- Maintain a project? Enroll it. If yours is eligible — “critical impact on infrastructure and user security” — submit a PR to the anthropics/oss-scanner repo. Free scans catch bugs before attackers do; each fixed CVE boosts your reputation.
- Sell AI-assisted security reviews. Maintainers will soon get more reports than they can triage. Offer validation as a service: test patches, prepare pull requests. Price per report or on retainer — the scanner creates demand, you sell judgment.
- Claim free Claude Max 20x. Anthropic’s Claude for OSS program gives maintainers free Claude Max 20x subscriptions to remediate scanner-found bugs — a pro-tier AI assistant at zero cost.
- Qualify for the Cyber Verification Program. Security professionals get advanced cyber capabilities with reduced blocking classifiers — a credential that differentiates a freelance practice.
- Practice responsible disclosure. Anthropic imposes no 90-day clock on unvalidated findings, because false positives exist. Validate before you publish. In security, reputation is built on accuracy, not speed.
Is this part of something bigger?
Yes. OSS Scanner launched under Anthropic’s Cyber Mission, alongside a Critical Infrastructure Defense Program for operational technology — power grids, water systems, transportation. Founding partners include Accenture, CrowdStrike, Deloitte, and Palo Alto Networks.
Anthropic is positioning Claude as defensive infrastructure, not just a coding assistant. Those who learn to triage AI-found bugs now will be the experts clients hire next.
Frequently Asked Questions
What is Anthropic OSS Scanner?
A free, opt-in service running periodic vulnerability scans on eligible open-source projects with Anthropic’s strongest models, including Claude Mythos. Reports are fully model-generated, with no human review.
How much does it cost?
Nothing. Anthropic covers the full cost of the scans for enrolled projects.
What does each report contain?
A self-contained reproducer, an explanation of the vulnerability (with a bisection to when the bug was introduced, where possible), and a candidate patch when available.
How accurate are the reports?
In Anthropic’s validation, 85 of 97 critical/high findings across 48 projects met its disclosure bar — about 88%, with one false positive. Anthropic still warns some reports may be wrong, so verify.
How does a project enroll?
A core maintainer submits a pull request to Anthropic’s oss-scanner GitHub repo, adding a project.yaml with the repo link, a contact email, and a Dockerfile that builds the project.
Is there a disclosure deadline for findings?
No 90-day period applies to unvalidated findings. If one is later validated through Anthropic’s coordinated disclosure process, the 90-day policy starts from the validation notice.
What free tools come with it?
Claude for OSS provides free Claude Max 20x subscriptions for remediation, and the Cyber Verification Program gives qualifying security professionals access to advanced cyber capabilities.
Sources
- An opt-in vulnerability-finding service for open-source software — Anthropic, October 8, 2026 (official announcement)
- OSS Scanner project page and FAQ — Anthropic (official)
- Anthropic OSS Scanner: free Mythos bug scans — BetaNews