Anthropic offers free AI security scans to open-source maintainers
Open-source maintainers can now have their code scanned for security vulnerabilities by an AI system, free of charge, and receive detailed reports with reproduction steps and suggested fixes. Anthropic’s new OSS Scanner uses the company’s strongest models to look for flaws in enrolled projects, sending findings straight to project teams without waiting for a human reviewer to sign off, which speeds up the path from detection to a fix.
The service is designed for projects that already have the capacity to triage verified high and critical severity reports and want more visibility into what their code is exposing. It builds on Anthropic’s earlier Project Glasswing, where Claude was used to hunt for software vulnerabilities, and is shaped by feedback from that work.
What OSS Scanner does for enrolled projects
Maintainers who are accepted into the program receive an initial scan of their codebase, followed by periodic scans that look for newly introduced vulnerabilities and for issues that earlier checks may have missed. The frequency of those follow-up scans depends on demand and on how widely the project is used in production.
Each report explains the suspected flaw, how to reproduce it and, when one is available, how to patch it. Maintainers can also tell Anthropic what to test, which inputs should be treated as potentially malicious, how severity should be rated and what kind of proposed patches would be most useful, so the output matches the project’s own security assumptions.
Why Anthropic moved away from human-first review
Anthropic has described human validation as a bottleneck in its vulnerability research. With Project Glasswing, every AI-generated finding had to pass through a human reviewer before reaching the affected project, and that review step slowed down reporting. OSS Scanner removes that step for routine findings: the AI’s output goes straight to the maintainers, and the maintainers decide what to verify and what to fix.
The company is clear that this is a trade-off. Findings delivered directly by the model are not guaranteed to be accurate, and some will overstate severity or misunderstand how a project is meant to be used. The responsibility for checking each report and deciding what to do with it sits with the maintainer, not with Anthropic.
Early results from the scanner’s pilot phase
Before the public launch, penetration testers evaluated an early version of the scanner across 48 open-source projects. They looked at 97 findings flagged as high or critical severity and assessed each one against Anthropic’s coordinated disclosure rules.
Of those 97 findings, 85 met the criteria for coordinated disclosure. Eleven were real vulnerabilities but duplicated issues that were already known or that overlapped with other reports. One was not a valid finding at all. Anthropic has acknowledged that the scanner is not perfect and that early reports produced before Project Glasswing were poor, but says the quality has improved substantially since then.
Feedback from one open-source foundation suggests the gap between human and AI reporting has narrowed for high-signal cases. A report that arrives with a working exploit attached is essentially what an engineer needs to start verifying and patching, and several project leads have described current AI-generated reports as comparable to, and sometimes better than, what human researchers send.
How disclosure deadlines work
Unvalidated findings produced by OSS Scanner do not come with a mandatory 90-day disclosure deadline. If a later review through Anthropic’s existing coordinated disclosure program confirms a report, a 90-day clock can begin from the moment the maintainer is notified of that validation. This is meant to give maintainers room to investigate without the pressure of an automatic public countdown on findings that have not yet been checked.
Projects that want to slow things down further can pause automated reports at any time, and they can opt out of the scanner entirely and fall back to receiving only reports under Anthropic’s standard disclosure process.
Who can apply and how
Applications are open to core maintainers of established projects that matter to infrastructure and to user security. Anthropic reviews each application on its own merits rather than running an open sign-up, and eligibility is focused on projects with a real install base and an active maintainer team.
Maintainers apply through the OSS Scanner GitHub repository, where the application process and the criteria for acceptance are documented.
What this means for open-source security going forward
Free, automated scanning removes one of the main costs of running a serious security program on an open-source project, and it gives small teams the same kind of continuous review that large companies pay for. The trade-off is that maintainers have to absorb more incoming reports, including some that will turn out to be wrong or overstated, and they need the engineering capacity to filter those out quickly.
For projects that can handle that load, the upside is faster signal on real vulnerabilities and earlier warning on issues that would otherwise sit in the codebase until a human researcher happened to find them.
FAQ
What is Anthropic’s OSS Scanner?
OSS Scanner is a free service from Anthropic that uses the company’s strongest AI models to find security vulnerabilities in open-source projects. Enrolled maintainers receive periodic scans and reports that explain suspected flaws, how to reproduce them and how to fix them when a patch is available.
How can open-source projects sign up for OSS Scanner?
Core maintainers of established projects important to infrastructure and user security can apply through the OSS Scanner GitHub repository. Anthropic reviews each application individually before accepting a project.
Do OSS Scanner reports have a 90-day disclosure deadline?
No. Unvalidated findings from the scanner do not carry a mandatory 90-day disclosure deadline. A 90-day period may begin only if Anthropic later validates a report through its existing coordinated disclosure program and notifies the maintainers of that validation.
Related coverage
- Keyorix: Open-Source Secrets Management for Teams That Need On-Premises Control
- AI Agent Gateway: open-source tool keeps model keys and MCP credentials out of agent configs
This article summarizes reporting from helpnetsecurity.com.