Anthropic has quietly started scanning open-source repositories for security flaws — and its Claude models have flagged more than 29,000 potential vulnerabilities in six months, according to coverage of the program. The service, called OSS Scanner, is free and entirely voluntary.
That last word matters. Anthropic is not sweeping GitHub for bugs and publishing its findings to the world. Instead, it asks maintainers to opt in, reviews each project individually, and sends results directly to the people responsible for fixing them. It is a noticeably careful approach to AI-driven security research, and it pairs Claude with established security firms in a broader initiative that also targets critical infrastructure.
Here is what the program is, how it works, and who has signed up so far.
TL;DR: Anthropic launched OSS Scanner, a free, opt-in vulnerability-finding service for open-source projects. Claude models have identified over 29,000 potential vulnerabilities during a six-month pilot phase. Maintainers apply for free scans, Anthropic reviews each application individually, and findings go straight to project maintainers rather than being published. Creators of Ethereum and Bitcoin wallet projects are among early participants, and the effort pairs Claude with leading security firms.
What Exactly Is Anthropic’s OSS Scanner?
OSS Scanner is a free service from Anthropic that checks open-source repositories for security vulnerabilities and sends the findings directly to project maintainers, according to Anthropic’s announcement and subsequent coverage. It is part of a wider cybersecurity initiative that Anthropic describes as a “long-term commitment” to securing critical infrastructure and open-source software.
The mechanics are straightforward. A project applies to the program, gets scanned by Claude-based tooling, and receives reports of potential weaknesses. Help Net Security’s coverage notes that the service also helps maintainers prioritize fixes, which addresses a common pain point: knowing a flaw exists is one thing, deciding what to patch first is another.
The program is a pilot at this stage. Open-source maintainers submit their applications, and Anthropic evaluates each project on its own merits rather than accepting everything automatically. Reports generated by the system are labeled as AI-generated, an acknowledgment that automated findings require human review before any action is taken.
Why build this at all? Because open-source software runs a huge share of the world’s infrastructure, and its maintainers are chronically under-resourced. A free scan costs a maintainer nothing but an application.
Why Is Anthropic Offering Free Vulnerability Scans to Open Source?
The stated motivation is protecting the software the world depends on. CyberScoop reports that Anthropic launched the initiative as a “long-term commitment” to secure critical infrastructure and open-source software, pairing Claude AI models with leading security firms. This is not a one-off marketing stunt framed as security research — the company explicitly frames it as an ongoing program.
The choice of open source as a target makes sense. Critical open-source libraries and wallet software sit underneath financial systems, government services, and countless applications. A single unpatched vulnerability in a widely used dependency can ripple outward for years.
Anthropic also gains something in return: real-world evaluation of how well its models find genuine security flaws. Running the scanner against live projects generates a track record. The 29,000-plus potential vulnerabilities reported over six months give the company — and the security community — concrete evidence of what Claude-based analysis can and cannot do.
Crucially, the service is free. Anthropic is not charging maintainers, and coverage consistently describes it as a voluntary program rather than a commercial product offering.
How Does the Opt-In Model Work in Practice?
The process starts with the maintainer, not the scanner. According to coverage of the program, lead maintainers of open-source projects can apply for free scanning, and Anthropic considers each application individually. There is no mass-scanning of repositories without permission.
Once a project is accepted, the scanning runs and the findings flow in one direction: to the maintainer. Anthropic’s announcement describes reports being sent directly to the people who maintain the code. This closed-loop design sidesteps one of the messiest problems in vulnerability research — what happens when an AI finds a flaw in code nobody asked it to inspect.
The reports themselves come with a clear caveat. Coverage of the program notes the findings are AI-generated reports, meaning they represent potential vulnerabilities flagged by Claude models rather than confirmed, weaponizable bugs. A maintainer receiving a report knows to verify before treating it as gospel.
For crypto-adjacent projects, the stakes are higher. BitHub.pl reports that creators of Ethereum and Bitcoin wallet projects are applying to the OSS Scanner pilot program — where a missed bug means lost funds, not just a patch Tuesday.
How Many Vulnerabilities Have Claude Models Found So Far?
More than 29,000 potential vulnerabilities in six months. That figure comes from coverage reporting on Anthropic’s models and the scanning program, and it is the headline number attached to the effort so far.
The word “potential” deserves emphasis. These are findings flagged by AI models, not 29,000 confirmed exploitable bugs. Automated vulnerability discovery inherently produces false positives, and the AI-generated nature of the reports means human maintainers must triage and validate each finding.
Still, the volume is significant for a pilot. It suggests the scanning pipeline is producing results at a scale that manual audits of volunteer-run projects could rarely match. Traditional security audits of open-source projects are expensive and slow; most small projects never get one at all.
What the number does not tell us is severity distribution, confirmation rate, or how many of those findings led to actual patches. Sources reporting on the program do not break down the 29,000 figure, so treating it as a raw count of flagged issues — rather than a count of verified vulnerabilities — is the accurate reading.
For maintainers, the practical takeaway is simpler: applying costs nothing, and the pilot has already demonstrated output at scale.
Which Projects Are Joining the Program?
The most notable early participants are in the cryptocurrency space. BitHub.pl reports that creators of Ethereum and Bitcoin wallet projects have applied to the OSS Scanner pilot program, drawn by the obvious appeal of automated review for code that safeguards real money.
Wallet software is a natural fit for this kind of scanning. The threat model is severe — a single flaw can result in stolen funds — and the codebases are often maintained by small teams that cannot afford recurring professional audits.
Beyond crypto, the program targets open-source projects broadly, with Anthropic evaluating applications one by one. Coverage indicates the wider initiative also extends to critical infrastructure security, with Anthropic partnering with leading security firms to combine Claude models with professional security expertise.
Notably, participation is gated. A project cannot simply turn the scanner on; its lead maintainers must apply and be accepted. This gives Anthropic a filtering mechanism and gives accepted projects a direct line to the findings.
The pilot structure also means the roster of participants will likely grow — or not — depending on how the first wave of scans and reports plays out in practice.
Frequently Asked Questions
Is OSS Scanner really free?
Yes. Multiple sources describe OSS Scanner as a free service for open-source projects. Anthropic covers the cost, and maintainers apply for scanning without any payment involved.
Do I have to sign up, or will Anthropic scan my project anyway?
You must opt in. Anthropic’s announcement describes the service as opt-in, and coverage confirms that lead maintainers apply for scanning with each project reviewed individually. No application means no scan.
Who sees the vulnerability reports?
The project maintainers. Anthropic states that findings are sent directly to project maintainers, which keeps sensitive security information out of public view until fixes can be made.
How many vulnerabilities has the program found so far?
Coverage reports that Anthropic’s models identified more than 29,000 potential vulnerabilities in open-source software over a six-month period. The figure counts AI-flagged findings, not confirmed exploitable bugs.
What Role Do Security Firms Play in the Initiative?
OSS Scanner is not a solo effort by Anthropic. According to CyberScoop, the program pairs Claude AI models with leading security firms to protect critical infrastructure and scan open-source software for vulnerabilities. That combination matters. AI models can analyze large volumes of code quickly, while security firms bring human expertise in validating and contextualizing findings. The initiative is framed by Anthropic as a long-term commitment to securing critical infrastructure and open-source software, not a one-off experiment. Sources describe OSS Scanner as a free, opt-in service: projects volunteer to participate rather than being scanned without consent. The involvement of professional security firms suggests an intent to reduce noise and improve the quality of reports that reach maintainers. Why does this pairing matter in practice? Because vulnerability triage is a persistent bottleneck for understaffed open-source projects, and combining automated discovery with expert review is one way to address it.
How Do AI-Generated Reports Reach Maintainers?
The delivery model is direct. According to CybersecurityNews, OSS Scanner checks critical open-source repositories for security vulnerabilities and sends findings directly to project maintainers. The reports themselves are explicitly labeled as AI-generated, as reflected in the program’s own materials. This direct-to-maintainer channel is a deliberate design choice. Instead of publishing findings publicly, the service routes them privately to the people responsible for the code. Help Net Security describes the goal as helping maintainers find flaws and prioritize fixes — meaning reports are intended to support decision-making about what to patch first, not just to dump raw output. Polish-language coverage adds that lead maintainers of open-source projects can apply for a free scan, and that Anthropic reviews each application on a case-by-case basis. That individual review process is a notable detail. It signals that the program is selective rather than open to automatic bulk enrollment of every repository.
How Is This Different From Traditional Vulnerability Scanners?
Traditional scanners typically detect known issues: misconfigurations, vulnerable dependency versions, patterns matching published signatures. OSS Scanner, as described in sources, uses AI models to search repositories for vulnerabilities — an approach aimed at finding potential flaws rather than only matching existing signatures. Coverage indicates that Anthropic’s models detected more than 29,000 potential vulnerabilities in open-source software over six months, a scale of discovery that sources link to this AI-driven method. Several other differences stand out:
- The service is free to participating open-source projects.
- Participation is opt-in — projects apply voluntarily.
- Applications from lead maintainers are reviewed individually by Anthropic.
- Findings go directly to maintainers rather than to a public feed.
- Reports are explicitly marked as AI-generated.
- The program pairs AI models with established security firms.
- The scope emphasizes critical open-source repositories and, per CyberScoop, critical infrastructure more broadly.
BitHub.pl notes that creators of Ethereum and Bitcoin wallet projects are among those signing up, suggesting interest from security-sensitive segments of the ecosystem.
What Are the Limitations and Open Questions?
Several open questions remain, and sources frame some of them explicitly. First, the scan results are described as potential vulnerabilities — the 29,000 figure counts findings that Anthropic’s models flagged, not confirmed, exploited, or fixed issues. How many of those reports turn into real, patched vulnerabilities is a question sources do not answer. Second, access is selective: Anthropic considers each project individually, so the service is not available on demand to every open-source repository. Third, the volume of AI-generated reports raises a familiar challenge for maintainers — triage. Help Net Security’s framing around helping maintainers “prioritize fixes” acknowledges that receiving findings is only useful if they can be ranked and acted upon. Fourth, responsibility: who validates each finding before it reaches a maintainer, and how much human review is applied, is not detailed in available coverage. What is clear is the opt-in structure. Projects choose to participate, which sidesteps the ethical controversies around scanning code without permission. That design choice may prove as significant as the technology itself.
What Does This Mean for the Future of Open-Source Security?
The program signals a shift in how major AI companies approach open-source security. Anthropic describes it as a long-term commitment covering both critical infrastructure and open-source software, per CyberScoop — language that suggests sustained investment rather than a short campaign. The scale achieved so far is concrete: more than 29,000 potential vulnerabilities detected in six months, with findings routed directly to maintainers of critical repositories. For the open-source ecosystem, a free opt-in service lowers the barrier to security review for projects that often lack dedicated security staff. The interest from Ethereum and Bitcoin wallet developers, reported by BitHub.pl, shows that high-stakes projects are paying attention. The broader question is whether AI-assisted discovery at this scale becomes a standard part of open-source maintenance. If individual project review keeps report quality high, the model could expand. If triage overwhelms maintainers, adoption may stall. Either way, the combination of AI models, security firms, and voluntary participation sets a template other vendors are likely to watch closely.
Frequently Asked Questions
How much does OSS Scanner cost?
OSS Scanner is free. Multiple sources, including CybersecurityNews and Help Net Security, describe it as a free service that scans open-source repositories and delivers findings to project maintainers at no charge.
Who can apply for a free scan?
Lead maintainers of open-source projects can apply for a free scan, according to coverage of the program. Anthropic considers each application on a case-by-case basis, and sources indicate the service focuses on critical open-source repositories.
Do findings go public automatically?
No. Sources describe findings being sent directly to project maintainers, and the program is explicitly opt-in — projects volunteer to participate. The reports are labeled as AI-generated and are delivered to the maintainers responsible for the code.
How large is the program’s track record so far?
Anthropic’s models detected more than 29,000 potential vulnerabilities in open-source software over a six-month period, according to coverage of the initiative. These are flagged findings from scans, delivered privately to participating maintainers.
Summary
- Anthropic launched OSS Scanner, a free, opt-in vulnerability-finding service that scans open-source repositories and sends AI-generated reports directly to project maintainers.
- The program pairs Claude AI models with leading security firms as part of what Anthropic describes as a long-term commitment to securing critical infrastructure and open-source software.
- Anthropic’s models have detected more than 29,000 potential vulnerabilities in six months, though these are flagged findings rather than confirmed patches.
- Access is selective: lead maintainers apply, and Anthropic reviews each project individually.
- Developers of Ethereum and Bitcoin wallet projects are among those applying to the pilot program.
If you maintain an open-source project, watch how the program’s review process and report quality evolve — and consider whether an application makes sense for your repository.