Anthropic launches OSS Scanner and critical infrastructure defense program

1. 07:14
   公众号Doonsec· Discussion

   AI vulnerability discovery service for the open-source ecosystem: an in-depth analysis of the Anthropic OSS Scanner's technical architecture, data effectiveness, and industry impact(opens the original post in a new tab)

1. 11:38
   公众号Doonsec· Discussion

   Anthropic opens AI vulnerability scanning for free: open-source software security is entering the era of AI automation(opens the original post in a new tab)

1. 15:42
   公众号Doonsec· Discussion

   Quick read: Anthropic launches a free AI vulnerability scanner(opens the original post in a new tab)
2. 12:25
   公众号Doonsec· Discussion

   Anthropic launched two new cybersecurity initiatives: open-source vulnerability quick reports and the OT critical infrastructure defense program landed; CNNVD published a notification on important AI security vulnerabilities | Niu Lan(opens the original post in a new tab)

1. 20:47
   The Hacker NewsSelected

   Anthropic launches OSS Scanner, a free AI vulnerability scanner for open-source projects

   Anthropic released OSS Scanner, an opt-in AI vulnerability scanning service for open-source projects, regularly scanned for free by its strongest models such as Claude Mythos, with reports fully generated by the models and not reviewed by humans. Core maintainers of a project need to submit a pull request and a YAML configuration file to the OSS Scanner GitHub repository, providing the git repository link to be cloned, the primary contact email, and a repository-relative path to a Dockerfile; the Dockerfile configures the runtime environment and preinstalls dependencies so that an offline agent can complete the security audit without network access. The YAML can optionally include a CC email, project homepage, a GPG public key for encrypting report emails, a threat model file path, or set disabled: true to opt out of receiving reports. Anthropic said the project's selection criteria are similar to Google's OSS-Fuzz, and there are currently 116 pull requests submitted.

2. 17:55
   Help Net Security AI

   Anthropic launches OSS Scanner, providing free AI security scans for open-source maintainers

   Anthropic launched a free service, OSS Scanner, which uses its strongest AI models to find security vulnerabilities in open-source software. Maintainers can voluntarily join and receive periodic scan reports containing suspected flaws, reproduction methods, and fixes when available. The service builds on the experience of Project Glasswing; Anthropic says manual verification has become the bottleneck in its vulnerability research, so OSS Scanner sends AI-generated findings directly to project teams without human review, leaving maintainers to verify and prioritize fixes. In an early version, the scanner produced 97 high- and critical-severity findings across 48 projects; after assessment by penetration testers, 85 met Anthropic's coordinated disclosure standards, 11 were real but duplicates of other known issues, and 1 was invalid. Anthropic says it cannot guarantee the scanner is perfect, and reports may exaggerate severity or misunderstand a project's security assumptions. Projects can pause automated reporting or opt out, receiving reports only through the standard disclosure process.

3. 14:27
   网页智东西· Discussion

   Nearly 5,000 vulnerabilities found in one month: Anthropic releases OSS Scanner, with its strongest model serving as a free "security guard"(opens the original post in a new tab)
4. 14:08
   网页IT之家· Discussion

   Anthropic launches OSS Scanner: using AI to scan open-source software for vulnerabilities for free(opens the original post in a new tab)
5. 11:26
   X @AISecHub

   Anthropic launches OSS Scanner, using frontier models to scan open-source projects for vulnerabilities for free

   Anthropic announced the launch of OSS Scanner, which will use its frontier models to periodically scan opted-in open-source projects for vulnerabilities. The service is free. Reports will provide proof-of-concept, explanations, and remediation suggestions.

6. 07:57
   网页The Register· Discussion

   AI company moves to defend critical infrastructure and open-source projects from AI(opens the original post in a new tab)
7. 05:53
   The Verge AI

   Anthropic launches OSS Scanner, a free open-source project security scanning service

   Anthropic launches a free service called OSS Scanner that provides regular security scans and vulnerability reports generated by its strongest models (including Claude Mythos) for opt-in open-source projects. The service generates reports entirely by model, without human review or triage, so scans are faster and more frequent, but reports may be wrong or invalid. Anthropic says this gives open-source projects a greater defensive advantage. Previously, AI tools have helped discover major security vulnerabilities in open-source software, such as the Copy Fail vulnerability in May that affected almost all Linux distributions; meanwhile, some open-source projects are struggling with a surge in AI-generated vulnerability reports, a situation encountered by Linus Torvalds and Google.

8. 05:32
   CyberScoop

   Anthropic launches critical infrastructure and open-source software security initiative

   Anthropic announced a critical infrastructure defense initiative, combining Claude models, its own engineers and threat research with the expertise of cybersecurity companies such as Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation to discover and fix security vulnerabilities in critical infrastructure and open-source software. Anthropic said it has provided frontier models and technical support to more than half of U.S. states and large critical infrastructure operators for scanning and patching code, or assisting with incident response and red teaming. The company also launched a voluntary scanning service for open-source software, where projects can receive regular scans for free, including proof-of-concept, explanations, and remediation suggestions; reports are returned faster but may contain inaccuracies. The long-term goal is to automate most of the classification and remediation work and to develop new security architectures and coding standards.

9. 04:23
   网页Techmeme· Discussion

   Anthropic launches OSS Scanner, which provides free, opt-in security audits for open-source projects by sending AI-generated reports without human review (Anthropic)(opens the original post in a new tab)
10. 03:00
    Anthropic ResearchSelected

    Anthropic launches OSS Scanner, an opt-in vulnerability discovery service for open-source software

    Anthropic launched OSS Scanner, an opt-in vulnerability scanning service for the open-source ecosystem, in which its strongest model periodically performs security scans for enrolled projects free of charge. Over the past six months, Anthropic used its latest model to scan important software projects and found more than 29,000 candidate vulnerabilities, but only about 6,000 were manually reviewed; at maintainers' request, nearly 5,000 reports that had not been manually verified were sent directly. The service's output is entirely model-generated, with no manual review or triage, so reports may be inaccurate. Anthropic asked expert penetration testers to verify 97 severe and high-severity vulnerabilities across 48 projects; 85 of them (88%) met its coordinated vulnerability disclosure process standards, 11 of 12 were duplicate findings, and only 1 was a false positive. Each report includes a reproducible example, a vulnerability description, and a candidate patch.

1. 17:04
   Anthropic

   Anthropic launches Anthropic Cyber Mission, initiating critical infrastructure defense initiative and OSS Scanner

   Anthropic launches long-term program Anthropic Cyber Mission, focusing on two directions: critical infrastructure and open source software. Among them, the Critical Infrastructure Defense Program (CIDP) provides frontier Claude models, resident engineers, and threat research to operational technology defenders in electricity, water, and transportation, with founding partners including CrowdStrike, Dragos, Palo Alto Networks, Rockwell Automation, and 11 others. The OSS Scanner provides free periodic security scans executed by Anthropic's strongest models for open source projects. This week, Anthropic merged Project Glasswing into the expanded Cyber Verification Program.

1. Date not given
   Anthropic Red TeamingSelected

   Anthropic launches OSS Scanner, providing free vulnerability scanning for open-source projects

   Anthropic launches OSS Scanner, offering optional free security scans for open-source repositories, with its strongest model scanning regularly and sending reports directly. The project stems from experience using Claude to find vulnerabilities in Project Glasswing. Projects that join receive fast-track reports without human verification; as of October 2026, Anthropic has manually reviewed more than 6,000 such reports. Core maintainers can sign up by submitting a PR to the anthropics/oss-scanner repository and adding a projects/<project>/project.yaml configuration, which must include the repository link, primary contact email, and a Dockerfile for offline auditing, with optional threat model file, GPG public key, and additional CC addresses. Scans run in a hardened sandbox with no network access, and reports are stored in an isolated cloud project accessible only to security personnel.

Current attention56·Peak in the comparable period73（Oct 10 00:00）·Change over the comparable past 24 hours -6%