Anthropic offers free AI vulnerability scans to open-source projects

• 

  Anthropic has launched OSS Scanner, a free, opt-in service that uses its AI models, including Claude Mythos, to scan open-source software for vulnerabilities.

• 

  Projects that join receive periodic, model-generated reports with explanations of suspected flaws, reproduction details and, when available, suggested fixes; the reports are not reviewed by humans before being sent.

• 

  Anthropic said it found more than 29,000 candidate vulnerabilities over six months, while its experts had manually reviewed about 6,000; The Hacker News reported that those findings had led to 584 advisories as of October 2, 2026.

• 

  In an assessment of 97 high- and critical-severity findings across 48 projects, Anthropic said 85 met its coordinated disclosure criteria, 11 were real but duplicative, and one was invalid.

• 

  Maintainers apply through the OSS Scanner GitHub repository, and Anthropic says it will assess applications individually, focusing on established projects important to infrastructure and user security.

• 

  Unvalidated reports do not have a mandatory 90-day disclosure deadline; if Anthropic later validates a report through its coordinated disclosure program, a 90-day period may begin when maintainers are notified.

Who

Anthropic and maintainers of open-source projects

What

Anthropic launched OSS Scanner, a free, opt-in AI vulnerability-scanning service.

When

Announced on October 9, 2026

Where

For open-source projects; applications are submitted through the OSS Scanner GitHub repository.

Why

To help open-source maintainers identify and fix security vulnerabilities, with faster reporting than a process requiring human review.

This story does not have two clearly opposing sides.