Anthropic offers free AI vulnerability scans for critical open-source software
The AI firm launches an opt-in scanner that sends automated security reports without human review to participating projects.
Key points
- Anthropic launched OSS Scanner on Thursday as a free service for the open-source ecosystem.
- The tool generates vulnerability reports using AI models without any human review process.
- Participation is strictly opt-in, drawing on lessons from Anthropic's previous Project Glasswing.
Organisations relying on critical open-source components now have access to a new automated security auditing service from Anthropic. The company launched OSS Scanner on Thursday, offering free vulnerability scans to projects that choose to participate. According to The Hacker News, the service aims to strengthen the broader open-source ecosystem by leveraging artificial intelligence. This move addresses the persistent resource constraints faced by maintainers of essential software libraries.
The scanner operates on an opt-in basis, meaning project maintainers must actively agree to join the programme. Anthropic stated that the service is informed by its experience using Claude to find vulnerabilities during Project Glasswing. Participants receive thorough, periodic security scans at no cost. The reports are generated directly by Anthropic’s strongest AI models, bypassing traditional human analyst review.
What we know
Anthropic introduced OSS Scanner on Thursday to provide automated security audits for open-source projects. The service is completely free for those who opt in. According to Anthropic, the initiative draws directly from the company’s internal experience with Project Glasswing, where they used Claude to identify security flaws. This background informs the design and operation of the new scanner.
The core mechanism of OSS Scanner relies on artificial intelligence rather than human analysts. Reports are generated by Anthropic’s strongest models and sent directly to project maintainers. There is no human review step in this process. The company describes the scans as thorough and periodic, ensuring continuous monitoring for participating projects. This approach allows for scalable security coverage across multiple open-source repositories.
The service targets critical open-source software specifically. By focusing on these high-impact areas, Anthropic aims to reduce risk for downstream users. The opt-in nature ensures that maintainers retain control over their codebases. This contrasts with automated scanning services that might push results without explicit consent. The lack of human review is a distinct feature of this particular offering.
Defender's checklist
- Verify if your organisation uses any open-source libraries that have joined the OSS Scanner programme.
- Monitor incoming AI-generated vulnerability reports for accuracy before applying any suggested patches.
- Establish a process for validating automated findings against your specific deployment environment.
- Review your current supply-chain security strategy to incorporate new automated auditing tools.
Background: Open-source software
Open-source software is code released with permissions that allow anyone to view, modify, and distribute it. This transparency enables community-driven development and rigorous peer review, distinguishing it fundamentally from proprietary systems where the internal logic remains hidden from the user.
Read the full guide: Open-Source Software: Meaning, Origins and Daily Use
What to do and how to stay safe: Anthropic
- Check if any critical open-source dependencies in your stack are participating in the Anthropic OSS Scanner programme.
- Review automated vulnerability reports for context, as AI-generated findings may require manual verification before action.
- Monitor project repositories for updates or patches related to vulnerabilities identified by automated scanners.
- Once the vendor provides an update, test it in a staging environment before deploying to production systems.
Step-by-step guide: Virtual Patching: Benefits, Limits and When to Use It
General security guidance from the TechWire Beat newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the Anthropic OSS Scanner service free to use?
Yes, Anthropic offers the scanner at no cost to open-source projects that choose to opt in.
Are the vulnerability reports reviewed by human analysts?
No, the reports are generated by AI models and sent without any human review.
How did Anthropic develop the OSS Scanner service?
The service is informed by Anthropic’s experience using Claude to find vulnerabilities during Project Glasswing.
