Anthropic launches OSS Scanner, providing free vulnerability scanning for open-source projects

Anthropic launches OSS Scanner, offering optional free security scans for open-source repositories, with its strongest model scanning regularly and sending reports directly. The project stems from experience using Claude to find vulnerabilities in Project Glasswing. Projects that join receive fast-track reports without human verification; as of October 2026, Anthropic has manually reviewed more than 6,000 such reports. Core maintainers can sign up by submitting a PR to the anthropics/oss-scanner repository and adding a projects/<project>/project.yaml configuration, which must include the repository link, primary contact email, and a Dockerfile for offline auditing, with optional threat model file, GPG public key, and additional CC addresses. Scans run in a hardened sandbox with no network access, and reports are stored in an isolated cloud project accessible only to security personnel.