Anthropic launches OSS Scanner, free AI vulnerability scans for open-source projects

Anthropic's opt-in OSS Scanner gives eligible open-source projects free periodic security scans from its strongest models, with no human review.

Anthropic launched OSS Scanner on October 8, 2026. The free, opt-in service gives enrolled open-source projects periodic security scans from the company's strongest models, including Claude Mythos, according to Anthropic's Frontier Red Team post. If you maintain an established project, the catch is that reports arrive with no human review, so triage is on you.

Anthropic says each report includes:

The company says it expects a true-positive rate above 90%, per its Cyber Mission announcement. In Anthropic's own validation, penetration testers checked 97 critical and high-severity findings across 48 projects. Of those, 85 met its disclosure bar, 11 were real but duplicates, and one was invalid. Anthropic also says maintainers have told it that severity ratings can be inflated, or that the scanner misunderstood a project's threat model.

Help Net Security reports how the service works in practice. Enrolled projects get an initial scan and a bundle of reports by email. Maintainers can say what to test and how to rate severity. Unvalidated findings carry no mandatory 90-day disclosure deadline, and projects can pause reports or opt out.

Eligibility is narrow. Core maintainers enroll by submitting a PR to Anthropic's GitHub repo, and Anthropic decides case by case, favoring projects with "critical impact on infrastructure and user security." TNW reports that the service agreement requires maintainers to review every report and caps Anthropic's liability at $1,000, with Anthropic's consumer terms also applying. Coverage so far doesn't spell out what repo access the scanner needs.

For teams outside the free program, Engadget notes that Anthropic's paid Claude Security product does similar code scanning and patching.

Sources