Anthropic offers open-source projects free AI-powered vulnerability scans

Anthropic has launched OSS Scanner, a free service that uses its most capable AI models to search open-source software for security vulnerabilities. Open-source projects can opt in to receive what Anthropic calls “thorough, periodic security scans” at no cost, according to the company.

The service targets a problem many open-source projects share: they are often maintained by small, volunteer teams without dedicated security staff to review code for flaws. By offering scans for free, Anthropic says it wants to give those projects a chance to catch problems before attackers find them first.

The scans themselves are run by what Anthropic describes as its strongest models, including Claude Mythos, the company’s most advanced model. Anthropic says using its top-tier models for the job gives maintainers “the largest defensive advantage” when hunting for flaws in their own code.

The service comes with a significant catch. Every report OSS Scanner produces is generated entirely by the AI model, with no human reviewing or checking it before it reaches a maintainer. Anthropic says skipping that human review step lets scans run faster and more often, but it also means some reports could turn out to be incorrect or invalid. Maintainers who opt in will need to verify each finding themselves rather than act on it directly, which adds its own share of extra work.

A mixed track record

AI-assisted bug hunting already has a track record in open-source software, and it cuts both ways. AI tools have helped uncover serious flaws in recent months, including one nicknamed “Copy Fail,” a bug that affected nearly every version of the Linux operating system when it surfaced in May.

But the same kind of tooling has also created a new burden for maintainers: a wave of AI-generated bug reports that turn out to be false alarms rather than real problems. Linux creator Linus Torvalds and Google have both said they are struggling to keep up with the volume of such reports arriving at their projects.

Anthropic has not said how many open-source projects have opted into OSS Scanner so far, how frequently scans will run, or what happens when a scan flags a vulnerability that turns out not to be real. Those details will matter for whether maintainers come to trust the service or simply add it to the pile of unreliable reports they already have to sort through by hand.

What to watch next is how maintainers who opt in respond once reports start arriving, and whether Anthropic publishes any figures on how often OSS Scanner’s unreviewed findings turn out to be accurate.