Anthropic offers free AI security scans as bug discoveries outpace human review

OSS Scanner will send findings directly to participating open-source maintainers without human checks, alongside a new program supporting critical infrastructure defenders

Anthropic’s Cyber Mission combines free open-source security scans with support for providers defending critical infrastructure.

Anthropic has introduced a free security scanning service for eligible open-source projects after its models identified more potential vulnerabilities than its researchers could manually review. OSS Scanner gives participating maintainers regular AI-generated reports, including explanations, evidence showing how a bug can be reproduced and proposed fixes where available.

The service is part of the Anthropic Cyber Mission which also brings Claude models, on-site engineers and threat research to providers protecting power grids, water systems, transportation networks and government systems.

Over the past six months, Anthropic says its models have discovered more than 29,000 candidate vulnerabilities in software projects. Its team has manually reviewed and assessed approximately 6,000. Nearly 5,000 reports have been sent directly to maintainers who requested all available findings, including those that had not been validated.

OSS Scanner formalizes that faster route. Reports arrive without human review, leaving participating projects responsible for checking findings and deciding which fixes to make.

Faster reports come with verification work

The scanner uses Anthropic’s most capable models, including Claude Mythos. It is intended for projects with enough capacity to investigate the reports they receive. Anthropic will continue its existing process for sharing human-verified vulnerabilities, particularly with projects that lack those resources.

In an evaluation of an early version, expert penetration testers examined 97 findings rated critical or high severity across 48 projects. Anthropic reports that 85, or 88%, met the standard for its coordinated vulnerability disclosure process. Of the remaining 12, 11 were genuine issues that duplicated known problems or other findings, and one was invalid.

Those results concern a selected set of high-severity findings rather than every report the service produces. Anthropic also acknowledges feedback that the scanner can overstate severity or misunderstand the security assumptions under which a project operates.

Feedback published with the announcement includes an account from Todd Ouska of wolfSSL: “We found the signal from these reports high: of the 74 reports we received, all but two were valid, and five became CVEs.”

The service builds on Project Glasswing, through which Anthropic scanned widely used open-source software and privately reported reviewed findings. The company says that work also exposed delays between discovering vulnerabilities and fixing them, sometimes lasting months.

Support for systems that cannot simply go offline

The Critical Infrastructure Defense Program addresses a different constraint: industrial equipment and control systems can be difficult to patch while they are running.

Anthropic will initially work through 11 providers that operators already use to secure their systems. Founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.

Several partners are already using Claude to address vulnerabilities, according to Anthropic. The company says it will use the initial group to establish which approaches are practical before extending the program to more partners and sectors.

Announcing the Cyber Mission on LinkedIn, Anthropic stated: “This work will take time, and we expect the Cyber Mission to change as we, together with the public and private sector, learn what works.”

Access depends on the project

OSS Scanner eligibility will be assessed case by case, with a focus on projects that have a critical impact on infrastructure and user security. Core maintainers can request enrollment by submitting a pull request using the project template in Anthropic’s OSS Scanner GitHub repository.

Companies providing security products or services for critical infrastructure can register interest in the defense program. Security teams and open-source maintainers can also apply to Anthropic’s expanded Cyber Verification Program for access to advanced Claude capabilities for defensive work.