Anthropic OSS Scanner is a free AI vulnerability scanner for open-source maintainers, and it has one design choice that will decide whether it helps you or buries you: the reports are not reviewed by a human before they land in your inbox. Anthropic launched it on October 8, 2026, and updated the eligibility rules on October 13.
That trade is deliberate. Anthropic says its models produced over 29,000 candidate vulnerabilities in six months and its staff could manually triage only about 6,000. I read Anthropic’s launch post, the program page, the enrollment repo’s README and the coverage to work out who should sign up, how enrollment actually works, and what the 88% accuracy figure does and does not mean.
What Is Anthropic OSS Scanner?
OSS Scanner is an opt-in program that runs periodic AI security audits on enrolled open-source projects using Anthropic’s strongest models, including Claude Mythos, at no cost to the project. It grew out of Project Glasswing, the effort that gave vetted organisations access to Claude Mythos for vulnerability research starting in April.
Each enrolled project gets an initial scan, a bundle of reports by email, and then rescans that look for newly introduced bugs and ones earlier passes missed. Per the launch post, each report includes:
- a self-contained reproducer
- an explanation of the bug
- a bisection showing when it was introduced, where possible
- a candidate patch, when one is available
Scan frequency is not fixed. The OSS Scanner program page says it depends on pipeline load, how widely the project is used and other factors. The pipeline itself uses agents to double-check bugs, propose patches and do root-cause analysis, so “unreviewed” means no human in the loop, not no verification at all.
Anthropic is explicit that the model inspiration is Google’s OSS-Fuzz, and that the eligibility test is borrowed from it too.
The Numbers Behind OSS Scanner
The case for automating disclosure rests on a backlog and an audit.
The backlog: over the last six months Anthropic’s models flagged 29,000+ candidate vulnerabilities in widely used software. Staff reviewed roughly 6,000. Nearly 5,000 more reports went straight to maintainers who had asked to see everything, validated or not. The Hacker News reports that work had produced 584 advisories as of October 2, 2026.
The audit: expert penetration testers reviewed 97 critical and high-severity findings from an early version of the scanner, across 48 projects.
- Met disclosure bar 85
- Real but duplicate 11
- False positive 1
Source: Anthropic, Launching an opt-in vulnerability-finding service for open-source software (Oct 2026)
Read that carefully. 85 of 97 is 88%, but 96 of 97 were real bugs. The 11 duplicates matter to you as a maintainer because a duplicate still costs triage time, yet they are not hallucinations.
The maintainer quotes are the strongest evidence. Todd Ouska of wolfSSL said “of the 74 reports we received, all but two were valid, and five became CVEs.” Anton Arapov of OpenSSL Corporation said the reports, including raw model output, “were as good and sometimes better than what we get from people.”
There is one more number in the launch post that explains why this exists now. On the CyberGym benchmark, Anthropic says language models went from finding under 20% of vulnerabilities at the start of 2025 to over 85% in 2026.
The audit sample is small and Anthropic-run, but one false positive in 97 high-severity findings is a strong result if it holds at scale.
How to Enroll in OSS Scanner: Step by Step
Enrollment is a pull request against anthropics/oss-scanner. A human reviews each one, checks that the contact is a real maintainer or a listed security contact such as the one in SECURITY.md, and checks that the Dockerfile scopes the scan to your project.
1. Add a project.yaml
Create projects/<name>/project.yaml from the template:
repo: https://github.com/example/project # required; add #branch to pin one
primary_contact: security@example.org # required; one address
auto_ccs: # optional
- maintainer@example.org
homepage: https://example.org # optional
disabled: false # optional; true pauses reports
dockerfile: .oss-scanner/Dockerfile # required unless the Dockerfile sits next to project.yaml
threat_model: .oss-scanner/threat_model.md # optionalThe README warns that these email addresses are public. Use a security alias, not your personal inbox.
If you want encrypted reports, add an armoured PGP public key under pgp:. Reports then go to primary_contact only, because PGP cannot be combined with auto_ccs.
2. Write a Dockerfile that builds offline
This is the step that will trip people up. The scanner builds your project in an isolated VM with network access, then moves the VM to a network with no internet for the audit itself. Anything your build or tests need must be fetched during the Dockerfile stage.
The README recommends keeping the Dockerfile in your own repo at a path like .oss-scanner/Dockerfile, so you can change the build without another PR to Anthropic. It also says to confirm your tests pass inside the built image.
3. Write a threat model
threat_model.md is optional, and I would treat it as mandatory. Anthropic says it is most useful for severity guidance: whether post-auth SQL injection is high or critical for you, whether buffer overflows without a demonstrated exploit cap at high, when stored XSS counts as medium.
Without it, the model guesses your threat model, and the launch post admits reports “can overstate severity or misread a project’s security assumptions.” Ten minutes writing this file is the cheapest way to cut noise.
4. Validate before opening the PR
pip install pyyaml
tools/validate.py # checks projects/<name>/ against the rules
tools/check <name> # builds like the scanner, opens a no-network shell
tools/check --qemu <name> # same, inside VMs laid out like the scanner'sTwo cautions from the README. tools/check runs your Dockerfile with network access, so only check projects you trust. It also installs Claude Code into the image, which is covered by its own terms.
When The Hacker News wrote its story, 116 enrollment PRs had been submitted.
Who Is Eligible for OSS Scanner?
Established projects with critical impact on infrastructure and user security, judged case by case using criteria similar to OSS-Fuzz. The October 13 update lists the factors: exposure to remote attack (libraries that parse untrusted input score well), users and dependents, age, update frequency, OpenSSF criticality score, an accepted open-source licence, and stars and forks.
New projects and most forks will not qualify. The bigger filter is capacity: Anthropic says the service is for teams that can already keep up with verified high and critical reports and have room for more.
If that is not you, you are not left out. Projects that cannot handle raw findings still get human-verified reports through Anthropic’s standard coordinated disclosure process.
OSS Scanner vs OSS-Fuzz vs Commercial AI Scanners
| Tool | Method | Cost | Human review before report | Best for |
|---|---|---|---|---|
| Anthropic OSS Scanner | LLM code audit, patches, bisection | Free | No | Logic and memory bugs in critical OSS |
| Google OSS-Fuzz | Fuzzing with sanitizers | Free | No (automated crash reports) | Continuous crash and memory-safety coverage |
| Claude Security | LLM audit for private code | Paid | Not stated | Enterprise source code |
| Codex Security Cloud | Scheduled GitHub repo scans + fixes | Paid ChatGPT plans | Not stated | Teams already on Codex |
(Source: Anthropic launch post and OSS Scanner page; Google OSS-Fuzz site; OpenAI DevDay 2026 coverage.)
OSS-Fuzz is the benchmark everyone will use. Google launched it in 2016 after Heartbleed, and by August 2023 it had helped identify and fix over 10,000 vulnerabilities and 36,000 bugs across about 1,000 projects.
Fuzzing and LLM audits are complements, not rivals. A fuzzer is cheap, deterministic and runs forever, but it finds what crashes. A model reads code, follows auth logic and writes the fix, which is how Anthropic’s early testers chained several findings into unauthenticated remote code execution. If your project is already in OSS-Fuzz, the same Dockerfile discipline will make OSS Scanner enrollment easy.
On the commercial side, OpenAI’s Codex Security Cloud does scheduled and on-demand GitHub scans with proposed fixes for Pro, Business, Enterprise and Edu plans, and Anthropic sells Claude Security for private enterprise code. Anthropic says OSS Scanner differs by running several harnesses, including token-heavy experimental ones, and covering the full cost.
For a critical open-source library, OSS Scanner plus OSS-Fuzz is the strongest free coverage available in 2026.
The Tradeoffs Maintainers Should Know
The disclosure rules are friendlier than I expected. Unvalidated findings carry no 90-day deadline, and the README says Anthropic “will not make them public.” A 90-day clock only starts if a report is later validated through Anthropic’s standard disclosure process and you are told. Anthropic reserves the right to add a disclosure period for some high-severity reports later, with advance notice and an opt-out.
The burden is the real cost. Five hundred plausible reports with patches attached is still five hundred things to read, and AI-generated code carries its own risks, as the data on AI-generated code security shows. Do not merge a candidate patch without the review you would give a stranger’s PR.
There is also a supply chain angle. Maintainers are prime targets, and the AI coding agent supply chain attacks of the past year mostly started with someone trusting an automated contribution. OSS Scanner reports arrive by email from Anthropic with an ANT-2026-… report ID, not as PRs, which is the right design. Verify the sender before acting on anything that looks like one.
On data handling, Anthropic says reports sit in an isolated cloud project accessible only to security staff who need them, and scanning agents run in hardened sandboxes with internet access disabled. That last detail matches the containment approach Anthropic described after its own agent overreach incidents earlier this month.
You can stop at any time. Set disabled: true to pause reports or delete projects/<name>/ to withdraw.
Should You Sign Up?
If you maintain a widely used library that parses untrusted input, yes, and write the threat model first. The wolfSSL and OpenSSL results suggest the signal is good enough to justify the inbox load.
If your project is small, the standard disclosure route will reach you anyway, with a human in the loop. If you want to understand where cheap, fast models sit next to slow, expensive ones like Mythos, today’s look at Mercury 3 and diffusion LLMs covers the other end of the spectrum.
Anthropic pairs the scanner with Claude for OSS, which offers maintainers a free Claude Max 20x subscription for remediation work, and with a separate Critical Infrastructure Defense Program for firms protecting power grids and water systems. SiliconANGLE lists 11 founding partners including CrowdStrike, Palo Alto Networks, Dragos and Booz Allen Hamilton.
OSS Scanner turns Anthropic’s vulnerability backlog into your inbox, and for critical projects that is a trade worth making, as long as you control severity through a threat model and review every patch.
