Anthropic has launched OSS Scanner, a free service that uses its AI models to find security vulnerabilities in open-source software, with scans and reports going to maintainers who opt in. Anthropic’s OSS Scanner reviews open-source projects with its AI models and sends vulnerability reports straight to the maintainers who patch them. For a small business, it is worth knowing which of these open-source components you rely on and keeping them up to date.
What happened
Anthropic has launched OSS Scanner, a free service that uses its AI models to find security vulnerabilities in open-source software, as reported by Help Net Security. Maintainers who opt in receive periodic scans and reports that explain each suspected flaw, how to reproduce it and, where available, how to fix it. Anthropic set out the details in its own announcement on October 8, 2026.
Are you affected?
For your business, the practical question is which open-source projects you rely on and how quickly you keep them up to date.
Maintainers from curl, OpenSSL, PostgreSQL and wolfSSL are among those who have given feedback on the scanner. If any of these are part of your systems, directly or through the products your vendors ship, keep track of them and apply updates when their maintainers release them.
Findings go to the project maintainers, who decide what to confirm and when to release a fix. In practice, watch for patches and advisories from the projects themselves and apply them promptly.
What to do now
- List which open-source projects your systems depend on, including curl, OpenSSL and PostgreSQL, and note which products from your vendors bundle them.
- Confirm your IT team or managed provider subscribes to security advisories for those projects and applies updates quickly.
- Prioritize applying new patches for these components as they are released.
- If your company maintains an open-source project important to infrastructure or user security, have a core maintainer apply through the OSS Scanner GitHub repository.
What the scanner has found so far
To validate an early version of the scanner, Anthropic asked penetration testers to assess 97 high and critical severity findings across 48 projects. Anthropic said 85 of them, 88 percent, met the bar for its coordinated disclosure process. Of the remaining 12, 11 were genuine but duplicated known issues or other findings from the scan, and only one was invalid, a false positive.
Maintainers of several large projects have reported similar results. Todd Ouska of wolfSSL said that of the 74 reports wolfSSL received, "all but two were valid, and five became CVEs". Daniel Stenberg of curl said OSS Scanner helped find multiple issues worth addressing, including "one of the worst curl vulnerabilities reported in the last few years". Noah Misch of PostgreSQL said several reports came with "fixes we can use nearly as-is", and that fast-track access let the project address the newest issues before they reached a GA release.
Anton Arapov of OpenSSL Corporation said the reports, including raw model output, were "as good and sometimes better than what we get from people," and that a report arriving with a working exploit attached can be verified right away.
Why Anthropic sends findings without human review
Anthropic says human validation has become a bottleneck in its vulnerability research. OSS Scanner sends AI-generated findings directly to project teams without that review step, which speeds up reporting but leaves maintainers responsible for checking each finding and deciding what to fix first. The service builds on Project Glasswing, an earlier effort in which Claude was used to find software vulnerabilities.
Anthropic was direct about the limits. "We can’t guarantee the scanner will be perfect," the company said, and acknowledged that reports can overstate severity or misunderstand a project’s security assumptions. For a small IT team, it is worth reviewing any security report before acting on it.
How to enroll and how disclosure works
Enrolled projects receive an initial scan and a bundle of reports by email. Later scans look for newly introduced vulnerabilities and for issues missed in earlier checks, and their frequency depends on factors including demand and how widely a project is used. Maintainers can tell Anthropic what to test, which inputs to treat as potentially malicious, how to rate severity and what kind of proposed patches would be useful. Anthropic says the service suits teams that can already keep up with verified high and critical reports and have capacity to investigate more.
Core maintainers can apply through the OSS Scanner GitHub repository. Applications are assessed individually, with eligibility focused on established projects important to infrastructure and user security. Unvalidated findings do not carry a mandatory 90-day disclosure deadline. If Anthropic later validates a report through its existing coordinated disclosure program, a 90-day period may begin when maintainers are notified of that validation. Projects can pause automated reports or opt out and return to receiving only reports under the company’s standard disclosure process.
FAQ
What is Anthropic’s OSS Scanner?
OSS Scanner is a free service that uses Anthropic’s AI models to find security vulnerabilities in open-source software. Maintainers who opt in receive periodic scans and reports that describe the suspected flaw, how to reproduce it and, where available, how to fix it.
How accurate have the scanner’s reports been in early testing?
Penetration testers reviewed 97 high and critical severity findings across 48 projects. Anthropic said 85, or 88 percent, met its coordinated disclosure criteria, 11 were genuine but duplicated known issues, and one was invalid. wolfSSL reported that of 74 reports it received, all but two were valid and five became CVEs. Anthropic has also said the scanner is not guaranteed to be perfect and that reports can overstate severity.
Which open-source projects has OSS Scanner already found flaws in?
Maintainers from curl, OpenSSL, PostgreSQL and wolfSSL have reported findings from the scanner. curl’s maintainer said it helped find one of the worst curl vulnerabilities reported in recent years, and wolfSSL said five of its reports became CVEs.
BizScoreAI
BizScoreAI scores how visible a business is to AI search and shows what its listing looks like to the engines people ask. Open the free listing check.