Anthropic Launches Free AI Vulnerability Scanner for Open-Source Projects
Summary
Anthropic’s free OSS Scanner periodically checks opted-in open-source projects for vulnerabilities and sends maintainers AI-generated reports with reproduction steps and possible fixes. Maintainers must validate findings; unvalidated reports have no mandatory 90-day-dis
Key points
- The free service uses Anthropic’s AI models to scan opted-in open-source projects periodically for suspected vulnerabilities.
- Reports go directly to maintainers and can include reproduction steps and proposed fixes.
- In an early assessment, penetration testers reviewed 97 high- and critical-severity findings across 48 projects: 85 met Anthropic’s coordinated disclosure criteria, 11 duplicated known issues or findings, and one was invalid.
- Anthropic cautions that reports may overstate severity or misunderstand a project’s security assumptions; maintainers are responsible for validation and prioritization.
- Eligibility is assessed individually and focuses on established projects important to infrastructure and user security.
- Unvalidated findings do not trigger a mandatory 90-day disclosure deadline; that period may begin if Anthropic validates a finding and notifies maintainers through its existing disclosure program.
- Maintainers can pause automated reports or opt out.
Article Details
- Event Type
- Launch of a free AI-powered security scanning service for open-source projects.
- Impact
- Opt-in maintainers receive periodic vulnerability reports with reproduction details and possible fixes. Findings are unvalidated and require project teams to verify and prioritize them; the article reports no mandatory 90-day disclosure deadline for unvalidated findings.