Anthropic has opened OSS Scanner, a free and opt-in service that sends security reports to maintainers of critical open-source projects. The findings are produced by the company’s strongest models and shipped without human triage.
Each report carries a self-contained reproducer, an explanation of the suspected flaw and, where possible, the commit that introduced it found by bisection, plus a candidate patch. Maintainers decide what to validate and what to merge.
The Frontier Red Team’s stated reason is arithmetic. Over six months its models surfaced more than 29,000 candidate vulnerabilities while researchers managed to review roughly 6,000 by hand. Maintainers who asked for early access had already taken delivery of nearly 5,000 unverified reports.
Anthropic tested an early build by asking penetration testers to assess 97 critical and high-severity findings across 48 projects. Eighty-five met its coordinated disclosure criteria, eleven were real but already known, and one was wrong. The company notes that this describes the sample rather than the accuracy of everything the service will emit.
Maintainers have been candid. PostgreSQL’s Noah Misch said fast-track access helped fix problems before a general release. OpenSSL’s Anton Arapov rated the raw reports as good as or better than human submissions when a working exploit made checking easy. wolfSSL’s Todd Ouska received 74 reports, judged all but two valid, and said five became CVEs.
Anthropic also concedes some severity ratings run high and some threat models are misread, which is a predictable cost of dropping the review step.
