# Anthropic launches free OSS Scanner for open‑source security

> Anthropic’s new OSS Scanner lets maintainers opt‑in to AI‑generated vulnerability reports and patches for critical projects.

Oossa · 2026-10-23 · https://oossa.com/en/anthropic-launches-free-oss-scanner-for-open-source-security

Anthropic announced on Oct 8, 2026 a free service called OSS Scanner. Project maintainers can sign up and receive AI‑produced security reports, complete with reproducer code, explanations and suggested patches. The reports are sent directly, without a human review step, and maintainers decide whether to validate and apply the fixes.

## How the service works

The scans are run by Anthropic’s strongest models, including Claude Mythos. After a maintainer submits a GitHub pull request with a Dockerfile that builds the project, the scanner runs offline and emails findings. Each report tries to pinpoint the change that introduced the bug using bisection, and it offers a candidate patch. Maintainers can add a threat‑model file to guide severity ratings and report format.

## Early results and community feedback

In the first six months the models flagged more than 29,000 candidate vulnerabilities, of which about 6,000 were manually reviewed. Early adopters have already seen dozens of unverified reports. For example, PostgreSQL maintainer Noah Misch said the fast‑track reports included fixes that could be used “nearly as‑is”. wolfSSL’s Todd Ouska reported 74 reports, with all but two confirmed valid and five turned into CVEs. curl’s Daniel Stenberg credited the scanner for discovering a use‑after‑free bug that was fixed in curl 8.23.0 (CVE‑2026‑92392).

## The facts

- Anthropic announced OSS Scanner on Oct 8, 2026.
- The models identified over 29,000 candidate vulnerabilities in the first six months.
- Human reviewers manually triaged about 6,000 of those candidates.
- wolfSSL received 74 reports; all but two were valid and five became CVEs.
- curl’s CVE‑2026‑92392 was fixed in version 8.23.0 after being reported by the scanner.

## Why it matters

Open‑source projects that power much of the internet now have a free, automated way to catch security bugs early, reducing the time they spend vulnerable. For developers, this means fewer manual code reviews and faster patches, though they still need to validate the AI‑generated fixes before deployment.

## Sources & references

1. [Anthropic Adds Opt-In Security Scanning for Critical Open-Source Projects](https://www.infoq.com/news/2026/10/anthropic-oss-security-scanner/?utm_campaign=infoq_content&utm_source=infoq&utm_medium=feed&utm_term=AI%2C+ML+%26+Data+Engineering) – InfoQ, 2026-10-23

Last updated: 2026-10-23