RELEASE · COMPANIES · #2490
Anthropic launches OSS Scanner — opt-in AI security scanning for critical open-source projects
Anthropic launched OSS Scanner, a free opt-in service that uses its strongest models (including Claude Mythos) to generate automated security reports for enrolled open-source projects. Reports include reproducers, bisection-based change attribution and candidate patches, are delivered without human review, and maintainers can choose whether to validate and apply fixes; Anthropic tested an early scanner on 97 findings and cites examples including a curl-reported CVE-2026-92392 fix.
KEY POINTS
- Anthropic launched OSS Scanner, a free opt-in service that uses its strongest models (including Claude Mythos) to generate automated security reports for enrolled open-source projects.
- Reports include reproducers, bisection-based change attribution and candidate patches, are delivered without human review, and maintainers can choose whether to validate and apply fixes; Anthropic tested an early scanner on 97 findings and cites examples including a curl-reported CVE-2026-92392 fix.
- The service shows how large language models can scale discovery and patch suggestion for critical OSS, while raising practical questions about false positives, maintainer workload and the risks of delivering unreviewed findings.
WHY IT MATTERS
The service shows how large language models can scale discovery and patch suggestion for critical OSS, while raising practical questions about false positives, maintainer workload and the risks of delivering unreviewed findings.