Anthropic has opened a free, opt-in scanner for established open-source projects that can handle raw security findings. Enrolled maintainers receive periodic reports produced by Claude models, including a reproducer, an explanation and, where possible, the change that introduced the bug and a candidate patch.
The service removes a human-review bottleneck. Anthropic says its models found more than 29,000 candidate vulnerabilities in six months, while researchers manually reviewed about 6,000. OSS Scanner sends automated findings directly to authorized project contacts, leaving maintainers to validate them and decide whether to accept a proposed fix.
An early assessment of 97 critical or high-severity findings across 48 projects found that 85 met coordinated-disclosure criteria, 11 were real but duplicated known findings, and one was invalid. That selected sample is not an accuracy rate for all future reports. Some maintainers have also reported exaggerated severity or misunderstandings of a project’s threat model.
Projects enroll through a GitHub pull request and can supply a threat-model file defining trusted inputs, scope and preferred reporting. Scans run without internet access after setup, and projects can pause or withdraw. The model may accelerate discovery, but deployed security still depends on maintainer verification, reachable-code analysis and getting fixes into the versions organizations actually use.