Anthropic announced on Oct 8, 2026 a free service called OSS Scanner. Project maintainers can sign up and receive AI‑produced security reports, complete with reproducer code, explanations and suggested patches. The reports are sent directly, without a human review step, and maintainers decide whether to validate and apply the fixes.
How the service works
The scans are run by Anthropic’s strongest models, including Claude Mythos. After a maintainer submits a GitHub pull request with a Dockerfile that builds the project, the scanner runs offline and emails findings. Each report tries to pinpoint the change that introduced the bug using bisection, and it offers a candidate patch. Maintainers can add a threat‑model file to guide severity ratings and report format.
Early results and community feedback
In the first six months the models flagged more than 29,000 candidate vulnerabilities, of which about 6,000 were manually reviewed. Early adopters have already seen dozens of unverified reports. For example, PostgreSQL maintainer Noah Misch said the fast‑track reports included fixes that could be used “nearly as‑is”. wolfSSL’s Todd Ouska reported 74 reports, with all but two confirmed valid and five turned into CVEs. curl’s Daniel Stenberg credited the scanner for discovering a use‑after‑free bug that was fixed in curl 8.23.0 (CVE‑2026‑92392).
Why it matters
Open‑source projects that power much of the internet now have a free, automated way to catch security bugs early, reducing the time they spend vulnerable. For developers, this means fewer manual code reviews and faster patches, though they still need to validate the AI‑generated fixes before deployment.
