Anthropic Launches Free OSS Scanner Vulnerability Scanner for Open-Source Code

Anthropic has opened access to OSS Scanner — a free vulnerability scanner for open-source projects. Over six months of intensive scanning, the company uncovered 29,000 vulnerability candidates, but manual review and triage became the bottleneck: only 6,000 reports were processed by hand. Despite the resource crunch, that didn't stop the findings from spreading — maintainers often asked to receive all the reports at once, even unverified ones. So far, 5,000 reports have been sent directly to maintainers at their request. Now Anthropic is offering a faster path: OSS Scanner runs in fast-track mode, generating reports instantly upon discovery, without manual validation.

Scale and Quality of the Findings

Anthropic's results on the NDCVE benchmark show that language models have significantly improved their ability to find vulnerabilities — from under 20% last year to over 85% this year. Penetration testing experts reviewed 97 critical and high-severity vulnerabilities from OSS Scanner across 48 different projects. The results are encouraging: 85 reports (88%) met the standards of Anthropic's CVD process. Of the remaining 12, 11 duplicated known issues, and only one was deemed a false positive — essentially an algorithmic error. The initial reports included hundreds of bug reports, some of which could be chained together to achieve unauthenticated remote code execution on the tested projects.

Reports will be fully generated by the model without human review — this speeds up scanning but means some findings may be incorrect or not applicable to a project's context. For maximum power, Anthropic is using its strongest models, including Claude Mythos.

Feedback from High-Profile Projects

Anthropic spent weeks validating the pipeline with dozens of open-source projects, gathering concrete feedback:

Noah Misch (PostgreSQL): "OSS Scanner found an unusually large number of defects in PostgreSQL. Several reports came with fixes that could be used almost as-is. Fast-track access let us address new issues before the GA release shipped."

Anton Arapov (OpenSSL Corporation): "Early AI reports 18 months ago, before Project Glasswing, were terrible. Reports from Anthropic, even the raw model output, are as good as or better than those from humans. When a report comes with a ready-made exploit, it's effectively a finished solution for an engineer."

Todd Ouska (wolfSSL): "Signal quality is high: of 74 reports received, all but two were valid, and five became CVEs. With patches attached, reports slot right into our review and fix process. We want more."

Eddie Kohler (HotCRP): "The reports are detailed and clear, showing a strong understanding of HotCRP's complex permissions model and good prioritization of issues."

Daniel Stenberg (curl): "We use every available state-of-the-art tool to find problems and harden our products. OSS Scanner helped us find several issues in curl worth fixing, including one of the worst vulnerabilities reported in recent years."

The reports include self-contained reproducers, an explanation of the vulnerability (including bisection to pinpoint when the bug was introduced), and suggested patches.

Process and Additional Programs

Anthropic drew inspiration from the success of OSS-Fuzz — a project that scans open-source code for vulnerabilities using fuzzers. OSS Scanner follows a similar principle but uses language models instead of dynamic analysis tools.

The company will continue sending manually verified reports through its existing coordinated vulnerability disclosure (CVD) process, especially for projects that lack the resources to triage on their own. But the fast-track option is now open to anyone who wants to respond to findings quickly.

Lead maintainers of eligible projects can sign up by submitting a pull request to Anthropic's repository using the standard template. Projects become eligible based on OSS-Fuzz criteria: they must have "critical impact on infrastructure and user security," with decisions made case by case.

Additional programs are also available:

• Cyber Verification Program — provides advanced cyber capabilities and reduced blocking classifiers for qualifying security professionals. • Claude Max 20x subscriptions — free for those helping fix vulnerabilities and improve open-source projects.