Anthropic's OSS Scanner Finds 880 Critical Vulnerabilities in Open-Source Code

Anthropic has launched OSS Scanner, a free, opt-in service that runs its strongest Claude models against eligible open-source codebases and emails unreviewed findings to maintainers. After the first week, the Claude Devs team reported 77 critical and 803 high-severity model-rated findings, including a vulnerability fixed in curl 8.23.0.

The scanner grew out of six months of work by Anthropic’s Frontier Red Team. Its models generated more than 29,000 candidate vulnerabilities in widely used software, while human specialists reviewed and triaged about 6,000. That gap prompted Anthropic to send model output directly to participating maintainers rather than limit scanning to findings its own staff could review.

Human review moves downstream

Every report is generated entirely by Anthropic’s models, including Claude Mythos, and reaches the maintainer without prior human review by Anthropic. The approach supports faster, more frequent scans while transferring responsibility for false positives, duplicate reports and severity decisions to participating projects.

Each report includes a self-contained reproducer and an explanation of the suspected vulnerability. Where possible, the model also identifies the commit that introduced the bug through bisection, a process that tests successive revisions to narrow down the change responsible. A candidate patch is included when available.

97 reports, one false positive

Before launch, Anthropic’s penetration testers reviewed 97 critical and high-severity findings across 48 projects. The sample produced the following results:

• 85 findings, or 88%: Met Anthropic’s standard for coordinated vulnerability disclosure.
• 11 findings: Described real issues but duplicated known vulnerabilities or other scanner reports.
• One finding: Was a false positive.

Anthropic reports similar results from early users. Of 74 reports sent to wolfSSL, all but two were valid and five received CVE identifiers. OpenSSL told the company that the raw output was comparable to, and sometimes better than, reports from human researchers. Anthropic also acknowledges recurring errors, including inflated severity ratings and incorrect assumptions about a project’s threat model.

A curl fix tests the scanner

curl offers a notable test because maintainer Daniel Stenberg had publicly criticized the volume of low-quality, AI-generated submissions to the project’s bug bounty, which closed in January. He later credited OSS Scanner with finding one of the most serious curl vulnerabilities reported in recent years.

curl 8.23.0, released on October 14, 2026, fixed CVE-2026-92392, a use-after-free flaw in HTTP/2 handling. This class of memory-safety bug allows software to access an object after releasing its memory. The advisory credits the discovery to “Luna, with Claude (Anthropic).”

Enrollment starts with a pull request

Eligibility follows criteria similar to Google’s OSS-Fuzz program and is limited to established projects with substantial infrastructure or user-security impact. Core maintainers apply through a pull request:

1. Open a pull request in the GitHub repository and add a projects/<project>/project.yaml configuration file.
2. Provide a Dockerfile that builds the project and installs its dependencies. The scanning agent runs without internet access inside a hardened sandbox.
3. Optionally add a threat_model.md file defining adversarial inputs, exclusions and the project’s severity rubric.
4. Optionally provide a GPG public key so Anthropic can encrypt emailed reports.

Anthropic manually verifies that applicants are core maintainers before starting scans. A project can pause reports by setting disabled: true in its configuration or withdraw by deleting its directory from the repository.

Raw reports carry no deadline

Reports that remain unvalidated carry no mandatory disclosure deadline. A 90-day clock begins only when Anthropic confirms a finding and accepts it into its coordinated-disclosure program. Maintainers can therefore triage raw scanner output without an Anthropic-imposed publication deadline.

Discovery scales faster than triage

Anthropic points to CyberGym, a benchmark for finding software vulnerabilities, as evidence of rapid improvement. According to the company, large language models found less than 20% of the benchmark’s vulnerabilities at the start of 2025 and more than 85% in 2026. Benchmark performance does not establish the scanner’s accuracy on every codebase, but it helps explain why Anthropic is expanding automated testing now.

Faster discovery leaves maintainers with a growing queue of reports to reproduce, deduplicate, rate and patch. OSS Scanner supplies evidence and, when possible, a proposed fix, while project teams retain responsibility for deciding whether a finding is valid and how urgently to address it. The service trades Anthropic’s review bottleneck for broader coverage and a larger triage workload inside participating projects.