Anthropic's OSSScanner scans open source without human review: 29,000 candidate vulns and counting
AGI Hunt · wechat · 2026-10-09
Anthropic announced its long-term CyberMission with two pillars: a Critical Infrastructure Defense Program (CIDP) for grids, water, and transit, and OSSScanner — a free AI-powered vulnerability scanner for open source projects.
How OSSScanner works
- Projects enroll via a PR to anthropics/oss-scanner (repo, contact email, Dockerfile, optional threat model); scanning agents run in an air-gapped sandbox
- Reports are fully model-generated with no human review before sending — each includes a standalone repro, explanation, and candidate patch. Anthropic expects 90%+ true positives
- External pen-testers checked 97 high/critical findings: 85 met disclosure standards; only 1 was a genuine false positive
Why skip review: in six months models surfaced 29,000+ candidate vulns but humans triaged only 6,000. With attackers able to write exploits in minutes, Anthropic shipped 5,000 reports directly. wolfSSL got 74 reports with just 2 invalid and 5 CVEs; OpenSSL maintainers said reports read as well as human-written ones. On CyberGym, model vuln discovery jumped from under 20% to over 85% this year. CIDP's 11 founding partners include CrowdStrike, Palo Alto Networks, and Dragos. Anthropic predicts defenders gain the upper hand within two years, while conceding verification and patching remain bottlenecks. Maintainers can also apply for a free Claude Max 20x subscription.
More from Safety
- DOJ and FBI seize Flax Typhoon hacking tools Microscan and FishHub — TechNadu · 2026-10-09
- OpenAI stands by firing three AI safety researchers over 'significant breach of trust' — The Verge AI · 2026-10-09
- We're putting too much faith in AI's ability to say no — nordicinst · 2026-10-09
- MIT Tech Review: We're putting too much faith in AI's ability to say no — MIT Tech Review AI · 2026-10-09
- 'Dystopian': Co-op latest firm to put staff under AI surveillance — marigo · 2026-10-09
- Anthropic's first policy update in over a year bans sustained cruelty toward Claude — AlexTensor · 2026-10-09