Anthropic's free scanner uses Claude to find bugs in open-source code

Anthropic launched the OSS Scanner on October 8, 2026, and within just 11 days it had already found 77 critical and 803 high-severity issues across enrolled projects ¹. The program is opt-in: project maintainers choose to join, and Anthropic runs its scans for free on its own servers.

What you could do with it

• Open-source project maintainers can enroll their critical projects for free periodic security scans, receiving AI-generated reports with bug reproducer tests, root cause explanations, and proposed patches sent directly to their inbox ¹.
• Security researchers and developers can use the scanner to rapidly discover vulnerabilities in infrastructure-critical open-source libraries like curl and wolfSSL without spending months manually auditing code ¹.
• Teams running open-source software that millions depend on can catch and fix serious security holes faster than traditional manual scanning allows, as demonstrated by curl patching a high-severity bug within days of discovery ¹.

From the announcement: A screenshot of the Anthropic OSS Scanner webpage showing the title 'OSS Scanner' with description text

Picture: red.anthropic.com

How it works

Open-source projects are like the foundation of a house — you might not see them, but everything else is built on top ¹. Libraries such as curl, which handles internet connections for millions of programs, are open-source and constantly scanned for security problems by hand. That process is slow ².

The OSS Scanner borrows its idea from Google's OSS-Fuzz, a well-known security program, but swaps traditional testing tools for Claude's AI agents ¹. Instead of sending broken test inputs at code, the scanner sends Claude's strongest models — including one called Claude Mythos — to read and analyze the source code directly .

To join, a project's main maintainers open a pull request (a proposed code change) on Anthropic's GitHub page and add a simple configuration file plus a Dockerfile, which tells the scanner how to build the project ³. The scan then runs inside a virtual machine with no internet connection, so the AI cannot accidentally access anything outside the project . Agents check the bugs it finds, figure out the root cause, and try to suggest fixes ¹.

Each report includes a self-contained test that proves the bug exists, an explanation of what went wrong, and — when possible — a proposed patch and a trace back to the exact commit that introduced the problem ³.

How accurate are the reports?

Anthropic asked its own penetration testers (security experts who practice finding vulnerabilities) to review 97 of the scanner's critical and high findings across 48 projects ¹. Eighty-eight percent of them met the bar for a formal disclosure — meaning they were real, serious issues worth reporting . Only one was a false positive .

Project maintainers saw similar results. The wolfSSL encryption library received 74 reports and said 72 were valid, with five officially assigned CVE numbers (standard vulnerability identifiers) ¹. The curl project patched a high-severity HTTP/2 bug (CVE-2026-92392) that affected versions 8.12.0 through 8.22.0 and was fixed in the October 14 release .

But there is a catch: none of the reports go through human review before reaching maintainers ³. Eleven of the 97 findings reviewed by Anthropic's team were duplicates of already-known issues ¹. Some maintainers have also reported that the scanner sometimes inflates severity ratings . Because the findings are unvalidated, there is no 90-day private-disclosure window attached, and Anthropic will not publish them publicly on its own .

Who is it for?

Anthropic accepted 114 projects out of roughly 650 applications as of October 19 ¹. The criteria mirror those of Google's OSS-Fuzz: projects should be critical to infrastructure, widely used, and exposed to remote attacks — for example, libraries that process untrusted input ². Brand-new projects and simple forks typically do not qualify .

The program is part of Anthropic's Frontier Red Team and Safeguards Research work, building on experience from Project Glasswing, where its models found over 29,000 candidate vulnerabilities in six months ¹. Of those, about 6,000 went through human review, while nearly 5,000 were sent straight to maintainers who had asked for everything — valid or not . The OSS Scanner turns that ad-hoc approach into a structured, opt-in service .

Anthropic's broader coordinated vulnerability disclosure dashboard listed 6,157 disclosed vulnerabilities across 591 projects as of October 2, with 516 already patched ¹. The company links the scanner's effectiveness to steady improvements in AI benchmarks: on CyberGym, a vulnerability-finding test, LLMs went from under 20% to over 85% accuracy .

This story reports on a trend for information only. It is not advice or encouragement to do any of it.

How good is it

Anthropic asked its own penetration testers to review 97 critical and high findings across 48 projects, and 88 percent of them were real issues worth reporting — only one was a false positive ¹. Maintainer feedback lines up: wolfSSL received 74 reports and said 72 were valid, with five earning official CVE numbers . The program found 77 critical and 803 high findings in just its first 11 days . Compared with Google OSS-Fuzz, which takes a different approach using traditional fuzzing tools, the Claude-based scanner trades human review for much faster turnaround .

Corrections and updates

• Corrected on 26 October 2026. An earlier version said the scanner found 803 high-severity findings; the source states 803 high model-rated findings.

Key facts

• Anthropic launched the free OSS Scanner on October 8, 2026, using Claude Mythos to audit open-source projects
• In 11 days the scanner found 77 critical and 803 high model-rated findings across enrolled projects
• 88% of 97 independently audited findings were valid; only 1 was a false positive
• Reports skip human review and go directly to maintainers; no 90-day disclosure window applies
• 114 projects were accepted out of about 650 applications as of October 19, 2026

Sources

1. Anthropic Launches OSS Scanner, a Free AI Vulnerability Scanner — marktechpost.com
2. OSS Scanner
3. GitHub - anthropics/oss-scanner