Nabil Luqman

0f9d2dd4f71434084e2b6094de1865e23abb37bb9f28ca51feeabee679ec9be2

Social

cybersecurity

open source

Anthropic

OSS Scanner

vulnerability

early applicants

Anthropic has launched OSS Scanner, a free, opt-in AI-powered vulnerability scanner designed to help open-source developers identify security weaknesses before attackers can exploit them. The service uses the company&rsquo;s most advanced artificial intelligence models, including Claude Mythos, to conduct periodic security scans and deliver reports directly to participating project maintainers.
The launch comes as AI tools become increasingly capable of detecting software vulnerabilities, creating new opportunities for cybersecurity teams while raising concerns about how quickly attackers could exploit similar capabilities. Although OSS Scanner aims to help developers identify flaws sooner, its reports are generated entirely by AI without human review or verification.
How Anthropic&rsquo;s OSS Scanner Works
&nbsp;<img src="https://r2.myc.my/034d3d67b409f1426c5fcd4e6a1ab008068c9654e58f6347a7a4f1c76f94c564" />
Inspired by Google&rsquo;s OSS-Fuzz, which helps identify vulnerabilities through automated software testing, OSS Scanner provides security scans to eligible open-source projects at no cost.
Participating developers can receive reports containing explanations of potential vulnerabilities, reproducible examples to help verify findings, information about when bugs may have been introduced and proposed patches where available. This could help maintainers investigate weaknesses and release fixes before they are exploited.
The service builds on Anthropic&rsquo;s experience using AI to identify software vulnerabilities through Project Glasswing. Over the past six months, the company said its models have identified more than 29,000 potential vulnerabilities across important software projects. However, its teams have only been able to manually review and triage around 6,000 findings, highlighting the difficulty of verifying security reports at scale.
OSS Scanner aims to reduce this bottleneck by allowing developers to receive potential vulnerability reports as soon as they are generated, rather than waiting for manual verification.
AI Reports May Still Contain Errors
<img src="https://r2.myc.my/c8c1a57cee0c225b26a56aeb4c48a3099416f5e6bf81eab3579ae87631bfeebf" />
Despite the benefits of faster scanning, Anthropic acknowledges that reports generated without human review may be inaccurate, duplicate known vulnerabilities or misinterpret a project&rsquo;s security requirements.
To evaluate an early version of OSS Scanner, the company asked specialist penetration testers to examine 97 critical- and high-severity findings across 48 projects. Anthropic reported that 85 findings, or approximately 88%, met its standards for its coordinated vulnerability disclosure (CVD) process.
Of the remaining 12 findings, 11 involved genuine issues that duplicated known vulnerabilities or other findings, while only one was considered invalid. Although the results suggest that the scanner can produce useful reports, they do not guarantee that every future finding will be accurate.
Anthropic said it would continue improving the system based on feedback from maintainers. It also acknowledged that severity ratings can sometimes be overstated or that reports may not account for a project&rsquo;s specific security model.
The company will maintain its existing CVD process, through which vulnerabilities are manually verified before disclosure. For OSS Scanner&rsquo;s initial unverified reports, Anthropic does not intend to impose a standard 90-day disclosure deadline. However, if a finding is subsequently verified by a human through its CVD programme, the company may apply its disclosure policy from the date the maintainer is notified of that verification.
Cryptocurrency Projects Among Early Applicants
<img src="https://r2.myc.my/a44db2e4567f7e5f977b102a9f97f6482a1f5e41fe8266a2d04209083ebd893e" />
Interest in OSS Scanner has extended to cryptocurrency projects, where vulnerabilities can potentially expose user funds or disrupt essential network operations.
Early applicants included Nethermind, an Ethereum client developer, and ZEUS, a self-custodial Bitcoin and Lightning wallet. VirtEngine, a decentralised cloud computing marketplace built on the Cosmos SDK, also submitted an application.
These projects highlight how AI-assisted security scanning could help protect software responsible for processing blockchain transactions, managing private keys and supporting cryptocurrency payments. However, submitting an application does not guarantee acceptance, as Anthropic evaluates projects individually.
Its selection criteria consider factors such as a project&rsquo;s importance to infrastructure and user security, exposure to remote attacks, and the number of users or downstream projects that depend on it.
Interest also extends beyond cryptocurrency, with developers working on AI assistants, machine-learning infrastructure, cloud storage, software development tools and energy-related systems among the wider applicant pool.
How Open-Source Developers Can Apply
<img src="https://r2.myc.my/63c6c877609083b07bcd48fba758da919518170ebd3ccf7c069064f8cc4d2cb0" />
Core maintainers of eligible projects can apply by submitting a pull request to the <a href="https://github.com/anthropics/oss-scanner">OSS Scanner GitHub</a> repository using the required project template.
Applicants must provide their repository link, an email address for the primary contact and a path to a Dockerfile that prepares the project&rsquo;s environment, installs dependencies and builds the software. This enables the AI agent to conduct its security audit within a prepared container without internet access.
Optional information includes additional email contacts, a project website, a public GPG key for encrypting report emails and a threat model outlining which parts of the code should be tested and how vulnerabilities should be classified.
Not every project will qualify. Anthropic said its selection criteria are similar to those used by OSS-Fuzz, prioritising projects with a critical impact on infrastructure and user security.
Anthropic Expands Its Cybersecurity Efforts
OSS Scanner is part of Anthropic&rsquo;s broader cybersecurity initiatives, alongside Project Glasswing and its Critical Infrastructure Defense Program, which aims to support organisations protecting essential systems.
The company has warned that AI could make it cheaper and faster for attackers to discover vulnerabilities, develop exploits and conduct cyber operations. This creates pressure on developers to identify and fix weaknesses before they can be used against their software.
Anthropic believes that continued advances in AI could eventually make it easier to detect bugs before software is released, build more secure systems from the outset and strengthen active cyber defence.
For open-source maintainers, OSS Scanner offers an additional way to identify potential vulnerabilities without paying for security scans. Its long-term value, however, will depend on the accuracy of its reports and how quickly developers can verify findings and implement fixes.
As AI continues to reshape cybersecurity, faster vulnerability detection could give defenders a valuable advantage. Human oversight and careful verification will nevertheless remain essential to ensuring that security issues are addressed accurately and responsibly.
&nbsp;
*Sources: Visual and Reference Credits to Social Media &amp; various cross-references for context.
FOMO much? Follow our&nbsp;<a style="color: #ff0000;" href="https://www.facebook.com/mycclub/">Facebook</a>&nbsp;and&nbsp;<a style="color: #ff0000;" href="https://www.instagram.com/myc_news/?hl=en">Instagram</a>&nbsp;for more updates.

AI is changing the cybersecurity game, helping developers uncover software weaknesses before hackers can exploit them.

a00114d6a8e2d84e40553c5ccc2d01ad7e99c50c8976786863c189c8889cbeba

Anthropic Launches Free AI Vulnerability Scanner For Open-Source Projects

55bcdeba72a510f10ee7d3ee191d14083b79f998fce8c15f7ec2a3c9ef951967

KFC Treats 2

4e116f10badae48c5f5b0fadbc8ad6152fc3b1fbde405ea844759cdeb2080544

Cornetto

b231707127825f4a15dd17fea55ac4d5a0ca0f639102a0e441db21b9629c225f

AXE MLBB

9621255847abc97937372c8dc13279f044806beb1dd21709fd1553c490afe2dd

BIllie Eilish UMMY

Anthropic Launches Free AI Vulnerability Scanner For Open-Source Projects

AI is changing the cybersecurity game, helping developers uncover software weaknesses before hackers can exploit them.

Latest News

No Malaysians Injured In Deadly Riyadh Airport Attack As Flights Face Disruptions

Indonesia Official Says Haze Is A Natural Phenomenon, Claims Its Forests Send Oxygen To Malaysia

Haze Forces School Closures Across Malaysia As Education Ministry Sets New API Rules

Putrajaya Launches New Autonomous Electric Bus Service For RM1 Per Trip

ShopeePay And Zurich Launch Two-Year Savings And Protection Plan From RM500

Related Articles

No Malaysians Injured In Deadly Riyadh Airport Attack As Flights Face Disruptions

Indonesia Official Says Haze Is A Natural Phenomenon, Claims Its Forests Send Oxygen To Malaysia

Haze Forces School Closures Across Malaysia As Education Ministry Sets New API Rules

Putrajaya Launches New Autonomous Electric Bus Service For RM1 Per Trip

Young K Brings His YOUNGEST Solo Tour To Kuala Lumpur In March 2027

Related Articles

No Malaysians Injured In Deadly Riyadh Airport Attack As Flights Face Disruptions

Indonesia Official Says Haze Is A Natural Phenomenon, Claims Its Forests Send Oxygen To Malaysia

Haze Forces School Closures Across Malaysia As Education Ministry Sets New API Rules

Putrajaya Launches New Autonomous Electric Bus Service For RM1 Per Trip

Young K Brings His YOUNGEST Solo Tour To Kuala Lumpur In March 2027