Anthropic launches free OSS Scanner powered by Claude Mythos for open source

Anthropic has launched OSS Scanner, a free service that regularly scans open source projects for vulnerabilities. It costs maintainers nothing. The work is done by the company's most powerful models, including Claude Mythos.

The wording in the announcement is short, but it points to three significant features. The service is free, meaning it is not a trial period or a stripped-down tier. The checks are regular, so this is continuous monitoring, not a one-off audit before a release. And instead of a lightweight model for mass tasks, Anthropic puts its flagship models on the scanning. For a company that earns money from subscriptions and API access, that is a notable decision: its most expensive models to run are being given to a task that brings in no direct revenue.

Why open source is the target

Open source code underlies almost every modern product, yet it is mostly watched over by volunteers or tiny teams. Heartbleed in OpenSSL in 2014 and Log4Shell in Log4j in 2021 showed how a single undetected bug in an obscure library can become a problem for hundreds of thousands of systems. Professional audits are expensive. Most projects never get one.

AI scanning targets exactly this gap. A model does not get tired, reads the entire codebase, and can return to it after every change. For a project with three maintainers, that can mean the difference between "we'll check it someday" and "checked last week."

There is a flip side. Maintainers, including those of curl, have complained publicly about a flood of meaningless AI-generated vulnerability reports that have to be sorted through by hand. Any scanner comes down to one metric: the false-positive rate. If the reports are accurate and reproducible, the service will save time. If they are noisy, it will add work for people who already have too much of it.

What the announcement leaves out

The source gives only a general description, and key parameters have not been disclosed. Here is what is known and what remains open:

• Developer: Anthropic.
• Cost: free.
• Frequency: regular scanning.
• Models: the company's most powerful, including Claude Mythos.
• Target: open source projects.
• Not specified: project selection criteria, limits on repository size, report format, the process for disclosing discovered vulnerabilities.

The last item matters most. Until a patch ships, a discovered vulnerability is dangerous knowledge. Whether the service becomes a safeguard or a source of risk depends on who receives the report first (only the maintainer, or Anthropic as well) and what disclosure deadlines apply.

What maintainers and companies should do

Maintainers should find out the onboarding terms in advance and make sure reports arrive through a private channel, for example private security advisories on their code hosting platform. It is best to test the first results on a small module and separately count the share of reproducible findings. That count will show the real value faster than any claims.

Companies whose products are built on open source should compare their dependency lists against the projects that join the service. If a key library is scanned regularly, that lowers the risk. But such scanning does not replace a company's own audit and CVE monitoring while the depth of analysis and the share of missed bugs remain unknown.

The main question for the coming months: how many real vulnerabilities the service will find, and how much time it will take from the people who have to triage them.