Anthropic Launches OSS Scanner

Anthropic, an artificial intelligence giant, has launched OSS Scanner, a new service that helps scan open-source code repositories for security vulnerabilities.

Much like Project Glasswing, OSS Scanner remains an opt-in service.

We regularly scan open source software for vulnerabilities and send reports after they have undergone human review as part of our coordinated vulnerability disclosure (CVD) process. By October 2026, we had reviewed over 6,000 such reports. This helps many projects secure their code without being overwhelmed by false positives. However, these manual review steps take time, so we’re not always able to share vulnerabilities as quickly as we would like.

OSS Scanner provides a much faster option. Enrolled projects can receive a vulnerability report immediately after a scan is completed, provided the maintainers are comfortable skipping the manual human review step.

Anthropic notes in its blog that the initiative was inspired by a similar project run by Google, OSS-Fuzz, which is widely known for uncovering errors, many of which have severe security implications for open-source software.

Inspired by Google’s approach, Anthropic is deploying its strongest models to to find vulnerabilities in open-source software.

Efficacy

Anthropic had expert penetration testers review the CVD findings from an early version of the OSS scanner, and the results were astonishingly good. Out of 97 critical vulnerabilities across 48 projects, 85 met the required standards. Eleven of the remaining 12 were either duplicates of known issues or secondary findings, with only one flagged as an invalid “false positive.” Anthropic has since forwarded many of these findings to the respective maintainers of the affected open-source projects.

So who is eligible to opt-in then?

Anthropic is sticking to acceptance criteria that are very similar to those currently leveraged by Google for its OSS-Fuzz project:

We accept established projects that have a critical impact on infrastructure and user security. We will consider each request on a case-by-case basis, but some things we keep in mind are: (1) Exposure to remote attacks (e.g. libraries that are used to process untrusted input); and (2) Number of users/other projects depending on this project.

Anthropic aims to standardize this process in the future. Depending on the volume of entries, they may adjust the acceptance criteria to manage demand.

Open-source maintainers are encouraged to write a brief summary explaining the importance and impact of their project if it is not immediately self-evident.

For security reasons, Anthropic will also manually validate the identity of a project’s core maintainer prior to completing enrollment.