Anthropic scans out more than 29,000 suspected vulnerabilities in half a year; Claude uncovers high-severity curl vulnerability fixed in 29 days

curl released 8.23.0 on October 14, fixing the high-severity vulnerability CVE-2026-92392; Claude appears in the acknowledgments list of the official announcement, and 29 days passed from receiving the report to releasing the update. The vulnerability is a use-after-free in the HTTP/2 upload process, and curl officially confirmed that a malicious server can achieve remote code execution when specific conditions are met. Anthropic launched OSS Scanner on October 8, calling models including Claude Mythos to provide free periodic scanning for eligible critical open-source projects; reports include vulnerability explanations, independently runnable reproduction materials, and candidate patches when conditions permit. In early spot checks, penetration testers reviewed 97 critical and high-severity findings across 48 projects, and 85 met the disclosure standard; of wolfSSL's 74 reports, 72 were valid, and 5 became CVEs. Anthropic says that over the past six months it found more than 29,000 candidate vulnerabilities, that humans completed review of only about 6,000, that nearly 5,000 automatically generated reports not verified by humans have been sent at maintainers' request, and that there is currently no 90-day public disclosure deadline.