After identifying more than 29,000 potential vulnerabilities but sorting only 6,000 by hand, Anthropic offers volunteer maintainers the opportunity to receive raw reports from its models directly.
Anthropic is launching OSS Scanner, an optional vulnerability scanning service reserved for free software. Projects that sign up for it will be screened regularly, free of charge, by the company's most powerful models, including Claude Mythos. The initiative is inspired by OSS-Fuzz, Google's program that has been testing open source code by fuzzing for years.
A human bottleneck
The starting point is a saturation observation: in six months, Anthropic's models flagged more than 29,000 candidate vulnerabilities in widely used software, but the team was only able to examine about 6,000 of them. More and more maintainers were asking to receive all the reports, even unverified ones, anyway: nearly 5,000 have already been sent to them in this way. According to the company, language models have gone through the CyberGym testbed from less than 20% of vulnerabilities found in early 2025 to more than 85% this year.
OSS Scanner's reports will be entirely AI-generated, without human sorting, which speeds up analysis but implies that some may be fake. Each will include a reproducible case, an explanation of the flaw, if possible the date of introduction of the bug, and a proposed fix. A pilot phase lasting several weeks with a few dozen projects produced hundreds of reports, including several flaws that can be combined up to remote code execution without authentication. The classic coordinated disclosure, verified by humans, is still offered to projects that do not have the means to triage themselves.
Read the full article on the original source
Go to the source →