OSS Scanner
A free open-source security vulnerability scanning tool released by Anthropic. It uses AI models to automatically detect security vulnerabilities in open-source code and provides vulnerability descriptions, proof-of-concept demonstrations, and remediation recommendations.
Timeline (last 90 days)
Anthropic launched the OSS Scanner program, using its most powerful model to provide free periodic security scans for critical open-source projects, with each finding including a proof of concept and a suggested patch.
OSS Scanner calls Anthropic's strongest models (including Claude Mythos) to analyze registered open-source code repositories for vulnerabilities.
The vulnerability reports OSS Scanner generates are sent directly to project maintainers, with no human review step in between.
Because human review is omitted, OSS Scanner shifts the triage workload of vulnerability reports onto open-source project teams.
Claude Mythos is one of the model identifiers used by Anthropic in the OSS Scanner product.
The article did not disclose the division of scanning work between Claude Mythos and other models, the prompt engineering design, or context window limits.
The launch of OSS Scanner came only 11 days after an event that occurred on October 8.
The criteria for selecting "critical open-source projects" (such as download volume, breadth of dependencies, or maintainers applying on their own initiative) were not made public.
Whether Anthropic provides a channel for false-positive feedback is currently unknown.
OSS Scanner sends reports privately to maintainers, consistent with the private notification principle of CVD.
13 more timeline events
All Facts (20)
Whether Anthropic provides a channel for false-positive feedback is currently unknown.
50%UnverifiedThe quality of the model's vulnerability reports depends on prompt design, code context coverage and false-positive control, none of which are disclosed in the available information.
50%UnverifiedOSS Scanner sends reports privately to maintainers, consistent with the private notification principle of CVD.
50%UnverifiedOSS Scanner calls Anthropic's strongest models (including Claude Mythos) to analyze registered open-source code repositories for vulnerabilities.
50%UnverifiedThe vulnerability reports OSS Scanner generates are sent directly to project maintainers, with no human review step in between.
50%UnverifiedBecause human review is omitted, OSS Scanner shifts the triage workload of vulnerability reports onto open-source project teams.
50%UnverifiedClaude Mythos is one of the model identifiers used by Anthropic in the OSS Scanner product.
50%UnverifiedThe article did not disclose the division of scanning work between Claude Mythos and other models, the prompt engineering design, or context window limits.
50%UnverifiedThe criteria for selecting "critical open-source projects" (such as download volume, breadth of dependencies, or maintainers applying on their own initiative) were not made public.
50%UnverifiedThe cost of scanning open-source projects for free with the strongest model is borne by Anthropic.
50%UnverifiedAnthropic says its OSS Scanner's scans over the past six months produced more than 29,000 candidate vulnerabilities, of which about 6,000 underwent human review and triage.
50%UnverifiedOSS Scanner is opened on an opt-in basis, and scan results are delivered with an 'unreviewed' status.
50%UnverifiedOSS Scanner's enrollment process requires projects to submit an enrollment PR rather than fill out a web form.
50%UnverifiedOSS Scanner is powered by Anthropic's strongest model.
50%UnverifiedCompleting enrollment in the form of a PR usually adds a configuration file or marker to the repository.
50%UnverifiedIt is recommended to view OSS Scanner as a supplementary signal rather than a replacement for security processes; handling model alerts first through automated filtering and then deciding whether to dig deeper manually can significantly lower triage costs.
50%UnverifiedOSS Scanner's scan report is labeled 'unreviewed', meaning the report has not undergone manual review.
50%UnverifiedOver the past six months, Anthropic used its model to identify more than 29,000 suspected vulnerabilities in open-source code, but only approximately 6,000 have been manually reviewed; of 97 high-severity findings across 48 reviewed projects, 88% met the standard, with the true positive rate expected to exceed 90%.
50%UnverifiedAnthropic launched the OSS Scanner program, using its most powerful model to provide free periodic security scans for critical open-source projects, with each finding including a proof of concept and a suggested patch.
50%UnverifiedThe launch of OSS Scanner came only 11 days after an event that occurred on October 8.
50%