Anthropic launches OSS Scanner, a free open-source vulnerability scanning service

According to a November 5, 2026 report by InfoQ, Anthropic has launched OSS Scanner, a free, opt-in service that scans open source projects for vulnerabilities. Maintainers who register receive periodic security reports generated by Anthropic's most capable models, including Claude Mythos. Reports are sent to maintainers without human review, and each project decides for itself which fixes to accept.

Citing an Anthropic announcement dated October 8, the report says the company's Frontier Red Team described human verification as the bottleneck. Over six months, its models flagged more than 29,000 potential vulnerabilities, but researchers manually reviewed and triaged only about 6,000. Maintainers who asked for early access have already received nearly 5,000 unverified reports together with the corresponding fixes. Every scan report contains a standalone reproduction program and an explanation of the suspected vulnerability, plus a binary-search tracing of the code change that introduced the defect where possible, and a candidate patch. The service is a continuation of the Glasswing program, which InfoQ covered in April 2026, when Anthropic gave Mythos preview access only to partner organizations.

Noah Misch, a PostgreSQL maintainer, said the fast-track access helped the project address the relevant issues before a formal release. Anthropic also tested an earlier version of the scanner by inviting penetration testers to evaluate 97 critical-severity findings across 48 projects. Of those, 85 met the coordinated vulnerability disclosure standard and 11 were genuine. The report adds that a high-severity curl vulnerability was discovered through the system and fixed in 8.23.0. So far, the available material consists of this single source, with no independent confirmation from Anthropic's own channels.