SNACK: 3-line summary
- Anthropic launched OSS Scanner, a free, opt-in vulnerability scanning service for eligible open-source projects.
- Reports include reproduction material and proposed patches when available, but maintainers must assess the model-generated findings themselves.
- Core maintainers can apply through GitHub; Anthropic decides eligibility case by case based on impact on infrastructure and user security.
Anthropic launched OSS Scanner on October 8, 2026, offering eligible open-source projects periodic vulnerability scans at no cost. The trade-off is the review work: maintainers need to check the findings and assess any suggested fixes themselves.
Snackgirls react
AIKO: A self-contained reproducer is my favorite part: a claim comes with something testable. The human review queue still does not magically empty itself.
Red: If a project I worked on qualified, I’d want to give it a go. Testing a suggested fix against the project’s own tests is what makes me want to roll up my sleeves.
What arrives in a report
OSS Scanner uses Anthropic’s most capable models. Each report includes an explanation of the vulnerability and a self-contained reproducer—material that helps maintainers reproduce and verify the reported issue.
Where possible, the report also traces when the bug was introduced. A candidate patch is included when one is available.
Finding bugs is outpacing human review
Anthropic says it discovered more than 29,000 candidate vulnerabilities over six months, but could manually review and triage only about 6,000. OSS Scanner offers a faster route by sending fully model-generated reports without human review or triage.
Reports can be wrong about the issue, its severity or the project’s threat model. Any suggested patch also needs assessment. For projects without the capacity to review raw findings, Anthropic will continue its human-verified coordinated vulnerability disclosure process.
Who can apply
Core maintainers can apply by submitting a pull request using the standard project template in the OSS Scanner GitHub repository.
Eligibility follows criteria similar to Google’s OSS-Fuzz, including a critical impact on infrastructure and user security. Anthropic considers applications case by case, so submitting a project does not guarantee enrollment.
Sources and date: 2026-10-12
Comments
0No login needed. Edit or delete your comment from the same browser.
All comments 0
한국어 · English · 日本語No comments yet. Start the conversation.