Anthropic Introduces OSS Scanner, Using Claude Mythos to Detect Open Source Vulnerabilities

On October 8, Anthropic announced the launch of OSS Scanner, an optional vulnerability detection service for open source software. The service is powered by Anthropic's most capable AI models, including Claude Mythos, offering regular free security scans. Maintainers of eligible open source projects can apply by submitting a pull request to the OSS Scanner GitHub repository, with review criteria similar to Google's OSS-Fuzz, prioritizing projects that have significant impact on critical infrastructure and user security.

Over the past six months, Anthropic used its latest models to scan multiple core software projects, identifying more than 29,000 candidate vulnerabilities. Due to limited manpower, only about 6,000 of these were manually reviewed and triaged. Anthropic said it will continue filing verified vulnerability reports through the existing coordinated vulnerability disclosure (CVD) process, while also offering an optional fast track for teams that want details as soon as reports are generated.

OSS Scanner results are fully generated by large language models without human review or triage. In recent weeks, Anthropic validated the automated pipeline on dozens of open source projects. To test the early version, Anthropic commissioned senior penetration testing experts to manually review 97 critical and high-severity vulnerabilities found across 48 projects. Of these, 85 (88%) met the bar for disclosure through the CVD process; 11 were real but known issues or duplicates, and only one was ultimately judged a false positive.

Anthropic said it cannot guarantee the scanner is perfect, and will continue improving the system based on maintainer feedback and underlying model iterations.