On October 8, Anthropic opened OSS Scanner, a free, opt-in service that periodically scans enrolled open-source projects with its most capable models, Claude Mythos among them, and emails the findings to maintainers. The reports go out “without human review or triage”. That choice removes the bottleneck that has held back Anthropic’s own bug reporting, and it moves the work of sorting real bugs from noise onto the people receiving them. Anthropic’s research post
The scanner arrived alongside a broader announcement Anthropic calls its cyber mission, which also covers a new program for critical infrastructure and free Claude subscriptions for open-source maintainers. Anthropic’s cyber mission post
Why Anthropic stopped waiting for human triage
Over six months, Anthropic’s models turned up more than 29,000 candidate vulnerabilities in open-source code. About 6,000 of those were manually reviewed, and human capacity was the limit. Nearly 5,000 further reports went directly to maintainers who had asked to receive everything, validated or not. Anthropic’s research post
Anthropic also cites the CyberGym benchmark: in its words, LLMs “have gone from finding under 20% of vulnerabilities at the beginning of last year to finding over 85% this year.” That is Anthropic’s summary of a benchmark trend, not a measurement of OSS Scanner. Anthropic’s research post Our explainer on how AI finds vulnerabilities covers the fuzzing and model-based techniques behind numbers like these.
Two accuracy numbers that measure different things
Anthropic gives two figures. Keep them apart.
| Figure | Source | What it covers |
|---|---|---|
| Above 90% | Cyber mission post | A forecast: “We expect a true-positive rate above 90%” |
| 88% (85 of 97) | Research post | Critical and high findings across 48 projects, checked by expert penetration testers, from an early version of the scanner |
Of the 12 sampled findings that did not meet the bar for Anthropic’s coordinated disclosure process, 11 were real bugs that were duplicates, either already known or found twice in the same scan. One was a false positive. Anthropic’s research post Anthropic’s cyber mission post
The measured number covers severe findings only, so it says little about lower-severity reports. And a duplicate still costs a maintainer the time to recognize it. Anthropic itself says it “can’t guarantee the scanner will be perfect.” Anthropic’s research post
The post also quotes maintainers, among them Todd Ouska of wolfSSL: “of the 74 reports we received, all but two were valid, and five became CVEs.” Anthropic chose which testimonials to print. Anthropic’s research post
What enrolling involves
A core maintainer opens a pull request against the anthropics/oss-scanner repository that adds a projects/<name>/ directory. OSS Scanner README
project.yaml:repoandprimary_contactare always required. Optional fields includeauto_ccs,homepage,pgp,threat_modelanddisabled. The emails in this file are public.- Dockerfile: sets up the environment, installs dependencies and builds the project. It can sit next to
project.yamlor live in the project’s own repo, referenced by adockerfile:path. threat_model.md: optional, and the README calls it “strongly recommended”.
The repo includes tools/validate.py and tools/check for testing an entry locally before submitting. Builds run in an isolated VM. Setup has network access, and the analysis runs with none. If the build fails, the primary contact gets an email. OSS Scanner README
Acceptance is not automatic. Anthropic says it is looking for projects with “critical impact on infrastructure and user security”, decided case by case using criteria similar to Google’s OSS-Fuzz, which inspired the service. Anthropic’s research post The service page adds that brand-new projects do not typically qualify, and that use is subject to the OSS Scanner terms and conditions. OSS Scanner service page
Delivery and disclosure terms
Reports arrive by email to primary_contact and anyone listed in auto_ccs. Adding an armored PGP key encrypts them, but then reports go to the primary contact only, because PGP cannot be combined with auto_ccs. Setting disabled: true “pauses reports without removing the enrolment”, and deleting the project directory withdraws it. OSS Scanner README
The reports themselves include a self-contained reproducer, an explanation, a bisection where possible and a candidate patch when one is available. Anthropic’s research post
On disclosure, read the README and the service page together. The README says Anthropic does “not place a 90-day disclosure period on these findings and will not make them public.” OSS Scanner README The service page confirms that unvalidated findings carry no 90-day clock, then adds a condition: if a finding is validated through Anthropic’s coordinated disclosure program, it may be disclosed starting 90 days from when the maintainer is notified that a human has validated the report. OSS Scanner service page Anthropic’s general disclosure policy aims for the industry-standard 90-day deadline. Anthropic’s coordinated vulnerability disclosure policy
In practice, the raw scanner output is private, but a bug that Anthropic’s people later confirm can start a public clock. Maintainers should treat a validation notice as the start of a deadline.
The decision for maintainers and dependency owners
For a small team behind a widely used library, the trade is free, frequent, model-written security review in exchange for an inbox you cannot fully control. Settle four things before enrolling:
- Who triages. Name a
primary_contactwho has time for it, not a shared alias nobody reads. If several people need reports, weighauto_ccsagainst PGP, since you cannot have both. - The threat model. The README strongly recommends
threat_model.md. It is where you describe which behavior is intended, and without it the scanner has less to go on when deciding what counts as a vulnerability in your project. - A triage log. Track each report as valid, duplicate, invalid or severity disputed. After a month you will have your own true-positive rate to set against Anthropic’s 88% and its forecast above 90%.
- The pause switch.
disabled: truekeeps the enrollment while stopping reports, which is useful during a release freeze.
Teams that only depend on a project cannot enroll it, since enrollment comes from core maintainers.
The rest of the cyber mission
The same post launched a Critical Infrastructure Defense Program. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation, and there is an interest form for other organizations. Anthropic also says that “earlier this week, we merged Project Glasswing into our expanded Cyber Verification Program”, which we covered when the verification tiers changed. Maintainers can apply for free Claude Max subscriptions through Claude for Open Source. Anthropic’s cyber mission post The research post specifies Max 20x. Anthropic’s research post
The cyber mission post announces no API changes.
What is still unknown
Anthropic has not said how often “periodic” scans run (its service page says rescan frequency may depend on the number of projects in its pipeline and how widely a project is used), how many reports a typical project should expect, or what the true-positive rate looks like below high severity. We have not seen details of how the Critical Infrastructure Defense Program works beyond its partner list. The 88% figure also comes from an early version of the scanner, not the one now running. Until maintainers publish their own triage results, every accuracy number for OSS Scanner is Anthropic’s.