This week Anthropic launched OSS Scanner, a free, opt-in service that uses its strongest models, including Claude Mythos, to hunt for vulnerabilities in open source projects. It is reminiscent of Google's OSS-Fuzz, except a model reasons about the code instead of a fuzzer.
It's opt-in: a project maintainer submits a pull request to the anthropics/oss-scanner repository on GitHub, provided the project meets eligibility criteria similar to OSS-Fuzz's, centered on its critical impact on infrastructure and user security. There is no cost for participating projects.
Each report includes a self-contained reproducer, an explanation of the vulnerability (including, when possible, when the bug was introduced) and a candidate patch if one exists. According to Techloy and Mezha, citing Anthropic's announcement, in validation runs with dozens of projects the scanner produced hundreds of reports, some with chainable flaws leading to unauthenticated remote code execution.
Anthropic acknowledges that the output goes through no human review or triage. That allows faster, more frequent scans, but some of the reports may be incorrect or invalid. For volunteer maintainers, who already suffer from floods of dubious reports, that's the real question: if the reproducer for each finding is good enough to verify in minutes, the service helps; if not, it just shifts the burden onto the people with the least time.
Anthropic also states that over the past six months its models identified more than 29,000 vulnerabilities in critical software. That figure comes from the company itself and was published without an independent breakdown, so it should be read as a vendor claim.
Carlos Montiel is an enterprise AI solutions architect. He implements LLMs, Agents, RAG, and orchestrators for companies across Guatemala and Latin America. Reach out for a consultation.
Contact Carlos Montiel