Anthropic launches opt-in OSS Scanner offering free, periodic AI-generated vulnerability scans for open-source projects

Anthropic has launched OSS Scanner, an opt-in service that gives open-source projects periodic vulnerability scans at no cost, run by its strongest models, including Claude Mythos. The reports are generated entirely by the model, with no human review or triage, so some will be wrong or invalid. The coverage comes from a Verge write-up quoting Anthropic, with no link to the primary announcement. Eligibility, scan frequency and the number of participating projects are not stated.

Maintainers of open-source projects get a free way to find security flaws, which could help under-resourced projects that cannot pay for audits. Enterprises that depend on open-source code could benefit indirectly if real bugs are found and fixed faster. The cost falls on maintainers, though, because unreviewed reports still need someone to check them. Linus Torvalds and Google are cited as already struggling with a flood of AI-generated bug reports, so the net effect depends on how many reports are valid. Impact is uncertain until there is data on accuracy.

The claim that the service gives open-source projects "the largest defensive advantage" is Anthropic's promotional framing and is unsupported by any figures. There are no reported vulnerabilities found, false-positive rates or named participants, and the Mythos capability claims are not independently verified here.

1. 01Published accuracy figures: the share of OSS Scanner reports that maintainers confirm as valid, versus the share dismissed as false positives, and the number of CVEs credited to it.
2. 02Maintainer reaction from major projects, including whether any opt in, complain about report volume, or ask for scans to be throttled or require triage.
3. 03Primary details from Anthropic: eligibility rules, scan frequency, the number of enrolled projects, and whether human triage or rate limits are added in the following months.