Anthropic launches OSS Scanner, providing free AI security scans for open-source maintainers

Anthropic launched a free service, OSS Scanner, which uses its strongest AI models to find security vulnerabilities in open-source software. Maintainers can voluntarily join and receive periodic scan reports containing suspected flaws, reproduction methods, and fixes when available. The service builds on the experience of Project Glasswing; Anthropic says manual verification has become the bottleneck in its vulnerability research, so OSS Scanner sends AI-generated findings directly to project teams without human review, leaving maintainers to verify and prioritize fixes. In an early version, the scanner produced 97 high- and critical-severity findings across 48 projects; after assessment by penetration testers, 85 met Anthropic's coordinated disclosure standards, 11 were real but duplicates of other known issues, and 1 was invalid. Anthropic says it cannot guarantee the scanner is perfect, and reports may exaggerate severity or misunderstand a project's security assumptions. Projects can pause automated reporting or opt out, receiving reports only through the standard disclosure process.