Anthropic has launched a free AI-powered vulnerability scanning service designed to help developers identify security flaws in open-source software. Called OSS Scanner, the opt-in service uses the company’s most advanced AI models, including Claude Mythos, to conduct periodic security scans and generate reports for eligible projects at no cost.
Announced on October 8, 2026, the initiative aims to help open-source maintainers detect and address vulnerabilities before attackers can exploit them. It is part of Anthropic’s broader effort to strengthen cybersecurity as artificial intelligence makes it easier to discover weaknesses in software.
How Anthropic’s OSS Scanner Works
OSS Scanner examines participating open-source projects for potential security vulnerabilities. It generates reports explaining identified weaknesses, providing details that can help maintainers understand the issues and work towards fixes.
Unlike traditional vulnerability assessment programmes that depend on security researchers to manually review every finding, the new service generates reports directly through AI models without human review or triage before delivery.
This approach could accelerate the discovery of software flaws and help developers receive security information more frequently. However, AI-generated findings may contain errors or false positives, making independent verification important before implementing changes.
How Open-Source Maintainers Can Apply
The service is optional, and projects must be accepted to participate. Core maintainers can apply by opening a pull request on the OSS Scanner GitHub repository and providing a YAML configuration file.
The configuration must include three key details:
- A link to the Git repository that Anthropic should scan.
- An email address for the project’s primary contact.
- A repository-relative path to a Dockerfile that prepares the environment, installs dependencies and builds the project for offline analysis.
Anthropic plans to select projects using criteria similar to those employed by Google’s OSS-Fuzz programme. The selection process may evolve, and maintainers may be asked to explain why their project is important if its significance is not immediately apparent.
Building on Project Glasswing’s Security Research
The launch follows Anthropic’s work under Project Glasswing, which explored how advanced AI models could identify vulnerabilities in widely used software.
The company said its research had identified more than 29,000 candidate vulnerabilities across important software projects. A little over 6,000 had been reported to maintainers, resulting in 584 security advisories as of October 2, 2026.
These figures highlight a significant challenge in cybersecurity: AI can identify potential weaknesses quickly, but validating findings, coordinating disclosures and deploying fixes still require considerable effort.
Part of Anthropic’s Wider Cybersecurity Mission
OSS Scanner is one part of Anthropic’s broader Cyber Mission. The company has also introduced a Critical Infrastructure Defense Program that provides advanced AI models, engineering support and threat research to organisations protecting systems such as power grids, water utilities and transportation networks.
The initiatives reflect a growing industry focus on using AI to strengthen defensive security while limiting the risks posed by the same technology in the hands of malicious actors.
What It Means for Open-Source Security
Free, recurring security scans could provide valuable support to projects that lack the funding to hire dedicated security teams. Nevertheless, maintainers should treat AI-generated reports as findings to investigate rather than automatically confirmed vulnerabilities.
The effectiveness of OSS Scanner will ultimately depend on the quality of its findings, the speed of remediation and the willingness of maintainers to participate.
Summary
Anthropic has introduced OSS Scanner, a free, opt-in AI vulnerability scanning service for eligible open-source projects. Using advanced models including Claude Mythos, it generates periodic security reports without human review before delivery. Maintainers can apply through a GitHub pull request and YAML configuration file. The service builds on Project Glasswing and aims to help developers identify software weaknesses earlier, although findings still require verification.
Image Source