Anthropic's free OSS Scanner hunts bugs in open-source projects
Maintainers can enrol their project for periodic vulnerability scans from Claude, with a proof of concept and a suggested fix, aiming for a 90%+ true-positive rate.
Anthropic opened sign-ups on 8 October for OSS Scanner, a free service that runs its frontier Claude models against open-source codebases looking for vulnerabilities. Maintainers enrol a project at red.anthropic.com/oss-scanner and get periodic scans; each finding comes with a proof of concept showing how the bug could be exploited, an explanation, and a suggested fix where one exists.
The reports are model-generated with no human review before they reach you, which is how Anthropic can offer scans at this scale for free. The company says it is targeting a true-positive rate above 90% and expects that to improve over time. It’s pitched at maintainers of “critical” projects who have the capacity to actually work through what gets surfaced, not a drive-by scan for any repo. The launch sits alongside a separate Critical Infrastructure Defense Program, built with partners including CrowdStrike, Palo Alto Networks and Dragos, aimed at operational technology behind power grids and water systems.
Why it matters: if you maintain a widely used open-source package, this is a free standing offer of continuous security review you’d otherwise have to pay for or do without. The proof-of-concept and suggested-fix format means less triage work than a bare CVE report.
The caveat: no human reviews the findings before they land in your inbox, so expect some false positives alongside the real ones.