Anthropic launches OSS Scanner, a free AI vulnerability scanner for open-source projects

Anthropic released OSS Scanner, an opt-in AI vulnerability scanning service for open-source projects, regularly scanned for free by its strongest models such as Claude Mythos, with reports fully generated by the models and not reviewed by humans. Core maintainers of a project need to submit a pull request and a YAML configuration file to the OSS Scanner GitHub repository, providing the git repository link to be cloned, the primary contact email, and a repository-relative path to a Dockerfile; the Dockerfile configures the runtime environment and preinstalls dependencies so that an offline agent can complete the security audit without network access. The YAML can optionally include a CC email, project homepage, a GPG public key for encrypting report emails, a threat model file path, or set disabled: true to opt out of receiving reports. Anthropic said the project's selection criteria are similar to Google's OSS-Fuzz, and there are currently 116 pull requests submitted.