Anthropic launches free OSS Scanner with unreviewed bug reports

Anthropic announced a free, opt-in vulnerability-scanning service for open-source projects on October 8, 2026, with an important condition: its reports reach maintainers without human review. OSS Scanner launched alongside a critical-infrastructure defense program under the company’s new Anthropic Cyber Mission.

The scanner addresses a backlog Anthropic’s models helped create. The company says it found more than 29,000 candidate vulnerabilities over six months but manually reviewed and triaged only about 6,000. Some maintainers asked to receive the unverified findings rather than wait. OSS Scanner turns that request into a recurring service for eligible projects with the capacity to handle the reports.

Each report includes a self-contained reproducer and an explanation, with a candidate patch when available. Skipping human review should get findings to maintainers faster, Anthropic says, but reports may be invalid or misjudge a bug’s severity. The company expects a true-positive rate above 90%; that is a forecast, not a measured result across the service.

Anthropic does report an early check: penetration testers who review its coordinated vulnerability disclosures examined 97 high- and critical-severity findings across 48 projects. Of those, 85 met its disclosure standard. Another 11 were real but duplicated known issues or other scanner findings; one was invalid. Those figures describe a check of an early version, not the accuracy of every report the service will produce. The company also says some maintainers found inflated severity ratings or misunderstandings of their projects’ threat models.

The infrastructure program takes a different route, working through the providers that operators already rely on. Anthropic says it will supply Claude models, on-site engineers and threat research to 11 founding partners, including Dragos, CrowdStrike, Accenture and Rockwell Automation. The target is operational technology—the controllers, software and industrial networks behind power, water and transport systems. As Anthropic notes, that equipment often cannot be taken offline for a patch.

Several partners were already using Claude to fix vulnerabilities, according to Anthropic. But the company described the initial small cohort as a way to learn which approaches are effective and practical, rather than presenting results showing how much the program has reduced risk.

For OSS Scanner, core maintainers can seek enrollment by submitting a pull request to the GitHub repository referenced in the launch post, following the standard project template. Admission is case by case, focused on projects with a critical impact on infrastructure and user security. Projects unable to triage raw findings will still receive human-verified reports through Anthropic’s existing disclosure process, the company says.