Short answer: OSS Scanner is a free, opt-in program from Anthropic in which core maintainers of established open-source projects get periodic security scans from Anthropic’s strongest models, with Claude Mythos among them. Enrollment opened Oct 8. You apply by opening a pull request to Anthropic’s oss-scanner repository. Reports arrive by email with a reproducer and sometimes a patch, and no person triages them first. Every success figure below is Anthropic’s own and has not been independently verified.

Disclosure: this post was drafted with Claude, which is made by Anthropic. Read the claims about Anthropic with that in mind and check the linked sources.

What is OSS Scanner and who can use it?

Per BetaNews, it is a no-cost, opt-in program for core maintainers. Eligibility is close to Google’s OSS-Fuzz, which favors established projects that matter for infrastructure and user security. Anthropic reviews each request individually and checks by hand that the applicant is a core maintainer. It says the service suits projects that already handle verified high and critical severity reports.

How do I apply?

Five steps for a maintainer: be a core maintainer, open a PR with project.yaml, optional threat model, receive email reports, pause or leave any time

The pull request adds a project.yaml file naming the repository, a primary contact email and a Dockerfile that builds the project. A threat model is optional. Projects can pause or leave at any time, per AI Weekly.

What do I get back?

If CVE and advisory identifiers are unfamiliar, see what is a CVE.

Scans run in an isolated virtual machine with no internet access after the build finishes. Agents in the pipeline re-check suspected bugs, draft patches and trace root causes. Maintainers get an email with a self-contained reproducer, a write-up, sometimes a bisection showing when the bug appeared, and a candidate fix when one exists. Follow-up scans run periodically.

How reliable is it?

Stacked bar: of 97 reviewed findings, 85 met the bar, 11 were real but already known, 1 was invalid

In Anthropic’s trial, penetration testers reviewed 97 critical and high-severity results across 48 projects. Anthropic says 85 (88%) met the bar, 11 were real but already known or duplicated, and one was invalid. That is Anthropic grading its own program. Anthropic also concedes that reports could be incorrect or invalid, and since no person reviews them before they reach you, a maintainer may spend time on a bad report.

What does the wider disclosure program look like?

Bars: 6,157 disclosed, 5,103 acknowledged, 516 patched upstream

According to Anthropic’s dashboard as of Oct 2, quoted by BetaNews, 6,157 vulnerabilities were disclosed across 591 projects, 5,103 were acknowledged by maintainers and 516 were patched upstream. Of 584 identifiers issued, 219 are CVEs and 365 are GitHub Security Advisories. Critics cited by AI Weekly point out that many fixes carry no CVE, so dependency scanners may not flag them. BetaNews also warns that 4,824 of the disclosures went straight to maintainers without outside review and may include false positives. Human triage is the slowest step, so these numbers cover only part of what the models find.

What does this mean for me?

  • If you maintain a well-known project: applying is cheap, but plan time to check each report yourself.
  • If you use open-source libraries: expect more patches without matching CVE numbers, so pin versions and read release notes.
  • If you run a small side project: you probably will not qualify, since Anthropic looks for established, widely used projects.

What I am unsure about

  • Whether the 88% rate holds outside Anthropic’s trial projects. It is self-reported.
  • How often scans will run for your project. Anthropic says it depends on the number of projects and how widely each is used.
  • Whether the program expands beyond core maintainers. Nothing I found says so.

I have not applied or run a scan myself.

FAQ

Is it really free?

Yes for enrolled projects, per Anthropic.

Will my vulnerabilities be published?

Anthropic says unvalidated findings carry no 90-day disclosure deadline and it does not plan to make them public. A 90-day clock starts only when a finding is validated through its coordinated-disclosure program.

Which model does the scan use?

Anthropic says its strongest models, with Claude Mythos among them, per BetaNews.

Sources

Written with AI assistance and checked against the sources above. See About for how ossbeat works.