Anthropic OSS Scanner Explained: Free AI Vulnerability Scanning for Open-Source Projects

Quick answer: OSS Scanner is a free, opt-in service from Anthropic that runs its strongest AI models, including Claude Mythos, against critical open-source codebases to find security vulnerabilities. Enrolled projects get periodic scans, and maintainers receive bug reports by email with a reproducer, an explanation and often a candidate patch. Anthropic pays the full cost. The trade-off: reports are fully model-generated and are not checked by a human before they reach maintainers.

OSS Scanner at a glance

Launched	8 October 2026 (updated with more detail on 13 and 23 October)
Built by	Anthropic’s Frontier Red Team with the Safeguards Research team
Price	Free; Anthropic covers compute and infrastructure
Who can join	Core maintainers of established, security-critical open-source projects
Models	Anthropic’s strongest models, including Claude Mythos
How to enroll	Pull request to the anthropics/oss-scanner GitHub repo
Human review	None before reports are sent
Repo licence	Apache-2.0

Why Anthropic built it

OSS Scanner grew out of Project Glasswing, Anthropic’s effort to use Claude to find vulnerabilities in widely used software. Over roughly six months, Anthropic says its models surfaced more than 29,000 candidate vulnerabilities in major projects. Its human security team could manually review and triage only about 6,000 of them, and nearly 5,000 more were sent directly to maintainers who asked to receive every finding.

In other words, the AI was finding bugs faster than people could check them. Human validation had become the bottleneck. OSS Scanner removes that step for projects that agree to receive raw model output, so scans can run more often and reach more projects.

Anthropic also points to how fast AI bug-finding has improved: on the CyberGym benchmark, language models went from finding under 20% of vulnerabilities at the start of last year to over 85% this year.

The design is modelled on Google’s OSS-Fuzz, which has found thousands of bugs in open-source software using fuzzers. OSS Scanner keeps the same “enroll your project, get continuous testing” idea, but swaps fuzzers for AI agents that read and reason about code.

How OSS Scanner works

1. Build: The project is built inside an isolated virtual machine using a Dockerfile supplied by the maintainer. This is the only stage with network access, so all dependencies, build tools and test files must be fetched here.
2. Go offline: Internet access is cut off completely. The scanning agents then audit the code in a hardened sandbox.
3. Hunt and verify: AI agents look for vulnerabilities, double-check each bug, perform root-cause analysis and, where possible, propose a patch.
4. Scope check: An automated harness confirms that each report is about the enrolled project itself and not one of its dependencies.
5. Report: Maintainers receive bundles of reports by email. Each includes a self-contained reproducer, an explanation of the flaw, a bisection to the commit that introduced it where possible, and a candidate patch when available.
6. Re-scan: Projects are scanned again periodically to catch newly introduced bugs and ones earlier scans missed. Frequency depends on demand and how widely the project is used.

The threat model file matters

Maintainers can add an optional (but strongly recommended) threat_model.md file. It tells the scanner where untrusted input enters the program, which components are out of scope, how to rate severity, and what kind of patches are useful. Without it, the scanner has to guess, which is one reason some maintainers have seen inflated severity ratings.

Early results

Before launch, expert penetration testers checked 97 critical and high-severity findings across 48 projects from an early version of the scanner:

• 85 (88%) met the bar for Anthropic’s coordinated vulnerability disclosure (CVD) process.
• 11 were real bugs but duplicated known issues or other scan findings.
• 1 was a false positive.

Maintainers of major projects have shared their experience:

• wolfSSL (Todd Ouska): “of the 74 reports we received, all but two were valid, and five became CVEs.”
• OpenSSL (Anton Arapov): the reports, raw model output included, “were as good and sometimes better than what we get from people.”
• PostgreSQL (Noah Misch): “An unusually high fraction of OSS Scanner’s findings uncovered PostgreSQL defects.”
• curl (Daniel Stenberg): “OSS Scanner has helped us find multiple issues in curl worthy of addressing.” Anthropic says this included one of the most serious curl vulnerabilities reported in recent years.
• HotCRP (Eddie Kohler): reports were “thorough and clear, with a strong understanding of HotCRP’s complex permission model.”

Demand is strong. According to MarkTechPost, about 650 projects had applied and 114 had been accepted by 19 October 2026.

Who is eligible?

Anthropic reviews each application individually, using criteria similar to OSS-Fuzz. It looks for established projects with a critical impact on infrastructure and user security. Factors include:

• Exposure to remote attacks, for example libraries that process untrusted input
• Number of users and dependent projects
• Project age and how actively it is maintained
• OpenSSF criticality score, stars, forks and usage
• An OSI-approved open-source licence

Brand-new projects usually don’t qualify, and forks are generally not scanned unless they are distinctly unique. Anthropic also wants teams that can already handle verified high and critical reports and have capacity to investigate more. A human confirms that each applicant is a core maintainer and that the security contact matches sources like the project’s SECURITY.md.

How to enroll your project

1. Fork github.com/anthropics/oss-scanner and add a folder at projects/<your-project>/.
2. Create a project.yaml with at least:
   • repo: your Git repository URL (you can pin a branch)
   • primary_contact: one security email address (use an alias, since the file is public)
   • dockerfile: the path to a Dockerfile that installs dependencies and builds the project (unless the Dockerfile sits next to project.yaml)
3. Optionally add auto_ccs, homepage, threat_model, a pgp public key for encrypted reports, or disabled: true to pause reports. Note that with PGP, reports go only to the primary contact.
4. Run tools/validate.py to check your config and tools/check <name> to build the project offline the way the scanner will. Only run checks on projects you trust, because the build step has network access.
5. Open a pull request. Anthropic reviews the request and the Dockerfile manually.

To pause reports later, set disabled: true. To leave entirely, delete your project folder. You then go back to receiving only human-reviewed reports through Anthropic’s standard disclosure process.

Disclosure rules

• Unvalidated findings have no 90-day disclosure deadline, because they may include false positives.
• If a report is later validated by a human through Anthropic’s CVD programme, it may be disclosed 90 days after maintainers are told it was validated.
• Anthropic says it may add a disclosure deadline for some high-severity reports in future, with advance notice and an opt-out.
• Crediting the scanner is optional. Maintainers who want to can include the report ID in a commit message, for example “Discovered by Anthropic’s OSS Scanner”.

Limitations to keep in mind

• No human in the loop: Some reports will be wrong or duplicate known issues. Maintainers must still reproduce bugs and test patches.
• Severity can be inflated: Some maintainers say the scanner overrates severity or misreads a project’s threat model, especially without a threat_model.md.
• Not for every project: It targets critical, widely used software, not hobby or brand-new repos.
• Maintainer workload: AI-generated bug reports have been a sore point in open source. OSS Scanner is opt-in precisely so only teams that want the volume get it.

How it compares

Programme	Approach	Cost to maintainers	Human review
Anthropic OSS Scanner	AI agents (Claude models)	Free	None before delivery
Google OSS-Fuzz	Fuzzing	Free	Automated
Anthropic Claude Security	AI agents, commercial product	Paid (enterprise)	Run by the customer

Anthropic also runs Claude for OSS, which gives maintainers free Claude Max 20x subscriptions to help fix vulnerabilities, and a Cyber Verification Program for vetted security professionals.

Why this matters

Open-source libraries like curl, OpenSSL and PostgreSQL sit underneath almost every app, website and device. Many are maintained by small teams with little funding for security audits. If AI can find real bugs at this scale and hand maintainers ready-made reproducers and patches, it could shift the balance toward defenders. Anthropic itself predicts AI will favour defenders within about two years. The open question is whether maintainers can keep up with the volume, which is why opt-in and good threat models are central to how the service works.

Frequently asked questions

Is Anthropic OSS Scanner really free?

Yes. Anthropic covers the full cost of scanning for accepted projects.

Can anyone sign up?

Only core maintainers of established, security-critical open-source projects. Each application is reviewed by a human.

Which AI model does it use?

Anthropic’s strongest models, including Claude Mythos, plus experimental, resource-intensive techniques.

Are the reports checked by a human?

No. Reports go straight to maintainers without human review, which is why there is no automatic 90-day disclosure deadline.

Where is the code and sign-up?

On GitHub at anthropics/oss-scanner. More details are on Anthropic’s red team site.

Sources: Anthropic research announcement and OSS Scanner FAQ (red.anthropic.com), the anthropics/oss-scanner GitHub repository, MarkTechPost, The Hacker News, Help Net Security and Cyber Security News.