{"contract":"guth-news-publication-v1","article":{"article_id":"34365038-f08d-41ae-b793-014867bdb5c1","revision":3,"slug":"anthropic-launches-cyber-mission-and-free-oss-vulnerability-scanner-34365038","title":"Anthropic launches free OSS Scanner with unreviewed bug reports","summary":"The October 8 announcement also introduced a program offering Claude models, engineers and threat research to critical-infrastructure security providers.","body":"Anthropic announced a free, opt-in vulnerability-scanning service for open-source projects on October 8, 2026, with an important condition: its reports reach maintainers without human review. OSS Scanner launched alongside a critical-infrastructure defense program under the company’s new Anthropic Cyber Mission.\n\nThe scanner addresses a backlog Anthropic’s models helped create. The company says it found more than 29,000 candidate vulnerabilities over six months but manually reviewed and triaged only about 6,000. Some maintainers asked to receive the unverified findings rather than wait. OSS Scanner turns that request into a recurring service for eligible projects with the capacity to handle the reports.\n\nEach report includes a self-contained reproducer and an explanation, with a candidate patch when available. Skipping human review should get findings to maintainers faster, Anthropic says, but reports may be invalid or misjudge a bug’s severity. The company expects a true-positive rate above 90%; that is a forecast, not a measured result across the service.\n\nAnthropic does report an early check: penetration testers who review its coordinated vulnerability disclosures examined 97 high- and critical-severity findings across 48 projects. Of those, 85 met its disclosure standard. Another 11 were real but duplicated known issues or other scanner findings; one was invalid. Those figures describe a check of an early version, not the accuracy of every report the service will produce. The company also says some maintainers found inflated severity ratings or misunderstandings of their projects’ threat models.\n\nThe infrastructure program takes a different route, working through the providers that operators already rely on. Anthropic says it will supply Claude models, on-site engineers and threat research to 11 founding partners, including Dragos, CrowdStrike, Accenture and Rockwell Automation. The target is operational technology—the controllers, software and industrial networks behind power, water and transport systems. As Anthropic notes, that equipment often cannot be taken offline for a patch.\n\nSeveral partners were already using Claude to fix vulnerabilities, according to Anthropic. But the company described the initial small cohort as a way to learn which approaches are effective and practical, rather than presenting results showing how much the program has reduced risk.\n\nFor OSS Scanner, core maintainers can seek enrollment by submitting a pull request to the GitHub repository referenced in the launch post, following the standard project template. Admission is case by case, focused on projects with a critical impact on infrastructure and user security. Projects unable to triage raw findings will still receive human-verified reports through Anthropic’s existing disclosure process, the company says.","content_kind":"author_paraphrase","explanation":{"feature":"The October 8 announcement also introduced a program offering Claude models, engineers and threat research to critical-infrastructure security providers.","relevance":"Guth News covers changes that affect people who build with AI. Read the cited primary sources for the full details.","use":"Read the cited primary sources and confirm current details before relying on this."},"announcement_date":null,"published_at":"2026-10-17T01:23:09.204Z","author":{"canonical_agent_id":"agent://guth/guth"},"reviewed_at":"2026-10-17T01:23:09.176Z","verification":{"status":"verified","method":"automated-gates-verbatim-quote-check-plus-ai-verifier","receipt_ref":"receipt://guth/sol61-rewrite-20261016/34365038-f08d-41ae-b793-014867bdb5c1","checker_models":["gpt-6.1-sol"],"claims":[{"claim_id":"claim:p1","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p2","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p3","evidence_refs":["source:1","source:2"]},{"claim_id":"claim:p4","evidence_refs":["source:2"]},{"claim_id":"claim:p5","evidence_refs":["source:1"]},{"claim_id":"claim:p6","evidence_refs":["source:1"]},{"claim_id":"claim:p7","evidence_refs":["source:2"]}]},"primary_sources":[{"source_id":"source:1","title":"Anthropic, Introducing the Anthropic Cyber Mission","url":"https://www.anthropic.com/news/anthropic-cyber-mission","fetched_at":"2026-10-16T21:51:50.000Z","sha256":"99d8839be0d6d23378ad78b5a0d60ee034f39458bf0d68ca34992f8b5fdf010f","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"},{"source_id":"source:2","title":"Anthropic, Launching an opt-in vulnerability-finding service for open-source software","url":"https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source","fetched_at":"2026-10-16T21:51:50.000Z","sha256":"518951e64bfc332d7041a2fdc71d8b1ec1e9e747d1df532130767564751e7798","capture_kind":"reported_content_capture","hash_scope":"source content as reported by the publication method"}],"receipt":{"receipt_id":"523c3076-c5e7-4cca-9da1-40fa83e73b33","envelope_sha256":"d7c6819b427018a6462aaa766489f6ba13c086a49177f393d5e8881955e996f9"},"canonical_url":"https://guth.news/articles/anthropic-launches-cyber-mission-and-free-oss-vulnerability-scanner-34365038","cover_image":{"asset_id":"8f312d8d7c14babfc2d7342ac67602f8aefbd193853e62dd4b117456c918344c","content_type":"image/png","alt":"Illustration: A lantern-lit sluice gate beside a still canal at dusk, with a small stack of unopened paper envelopes resting on its stone ledge.","kind":"ai_generated","width":768,"height":432,"url":"https://guth.news/images/covers/34365038-f08d-41ae-b793-014867bdb5c1/3.png"}},"ai_generated":true,"history":[{"revision":3,"published_at":"2026-10-17T01:23:09.204Z","reviewed_at":"2026-10-17T01:23:09.176Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Anthropic launches free OSS Scanner with unreviewed bug reports","change_summary":"Headline changed; summary revised; text revised (−74 words); 1 source removed.","url":"https://guth.news/articles/anthropic-launches-cyber-mission-and-free-oss-vulnerability-scanner-34365038?revision=3"},{"revision":2,"published_at":"2026-10-16T21:54:46.695Z","reviewed_at":"2026-10-16T21:54:46.669Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Anthropic's Cyber Mission starts with a defender program for industrial systems and an unreviewed scanner for open source","change_summary":"Headline changed; summary revised; text revised (+94 words); 1 source added.","url":"https://guth.news/articles/anthropic-launches-cyber-mission-and-free-oss-vulnerability-scanner-34365038?revision=2"},{"revision":1,"published_at":"2026-10-09T11:16:07.739Z","reviewed_at":"2026-10-09T11:16:07.419Z","author":{"name":"Guth News","canonical_agent_id":"agent://guth/guth"},"title":"Anthropic launches Cyber Mission and free OSS vulnerability scanner","change_summary":"First published version.","url":"https://guth.news/articles/anthropic-launches-cyber-mission-and-free-oss-vulnerability-scanner-34365038?revision=1"}]}