Anthropic introduces free ai-powered tool to scan open-source projects for vulnerabilities

Anthropic has launched OSS Scanner, a free, opt-in tool using its strongest AI models to identify vulnerabilities in open-source projects. Launched on October 8, the tool runs on Claude Mythos, automatically reporting findings to maintainers without human review. Within 11 days, it identified 77 critical and 803 high-severity issues. Models flagged over 29,000 potential issues over six months, with human reviewers triaging around 6,000 and nearly 5,000 sent directly to maintainers. Anthropic’s penetration testers validated 97 critical and high-severity findings across 48 projects. wolfSSL received 74 reports, with 5 becoming CVEs, including a high-severity flaw in curl fixed in version 8.23.0, released on October 14, 2026. OSS Scanner requires maintainers to enroll via a pull request, adding a project-specific configuration file. Audits run in an isolated network environment using Docker and VMs. Each report includes a self-contained reproducer, root cause analysis, and potential patches. An optional threat_model.md file allows for more precise assessments. Anthropic also highlighted progress on CyberGym, where LLMs improved from identifying under 20% to over 85% of vulnerabilities. The company’s CVD dashboard lists 6,157 disclosed vulnerabilities across 591 projects, with 516 patched.