Key points
- Anthropic introduced OSS Scanner on Thursday as a free service for the open-source ecosystem.
- The tool generates security reports using AI models without any human review before delivery.
- The initiative draws on Anthropic’s experience using Claude during Project Glasswing.
Anthropic launched OSS Scanner on Thursday, a new service designed to help secure open-source software. According to The Hacker News, the company unveiled this opt-in vulnerability scanner to assist the broader ecosystem. The service is free for participating projects and utilizes artificial intelligence to identify potential security flaws in code repositories.
In plain English
Traditional security audits often rely on human experts to review code manually. OSS Scanner changes this process by using AI models to perform the analysis instead. As Anthropic noted in its announcement, the reports generated by the scanner are sent directly to project maintainers without any human review. This means the findings come straight from the software’s algorithms.
The background
The development of this tool was informed by Anthropic’s previous work. According to Anthropic, the scanner is "informed by our experience using Claude to find vulnerabilities during Project Glasswing." Project Glasswing was an earlier initiative where the company used its AI assistant to scan for security issues. OSS Scanner applies that same methodological approach to external projects.
What changes now
Projects that choose to join the program will receive thorough, periodic security scans. Anthropic stated that these scans are conducted by its "strongest models at no cost." Because the reports are AI-generated and not pre-vetted by staff, maintainers must interpret the findings themselves. This approach aims to scale security checks across critical open-source software more rapidly than manual audits allow.
What to do and how to stay safe: Anthropic
- Review automated AI findings carefully before treating them as confirmed vulnerabilities.
- Verify any reported issues against your own codebase and testing environment.
- Monitor official channels from Anthropic for updates on the scanner’s accuracy.
- Ensure your project’s contact details are up to date if you opt in.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the OSS Scanner service free to use?
Yes, Anthropic provides the vulnerability scans at no cost for projects that opt in to the service.
Are the security reports reviewed by humans before sending?
No, Anthropic explicitly states that the AI-generated reports are sent without any human review.
What previous project influenced the creation of this scanner?
The scanner was informed by Anthropic’s experience using Claude to find bugs during Project Glasswing.
