Anthropic rolls out opt-in AI scanner to audit critical open-source projects without human review

Anthropic has launched a new tool called OSS Scanner, designed to identify vulnerabilities in critical open-source software. The service is free and operates on an opt-in basis, allowing project maintainers to request security audits. According to The Hacker News, Anthropic unveiled the scanner on Thursday, positioning it as a resource to strengthen the broader open-source ecosystem using artificial intelligence.

In plain English

OSS Scanner functions as an automated security auditor for open-source code. Instead of relying on manual reviews by human security researchers, the service uses Anthropic’s most advanced AI models to scan codebases for potential weaknesses. Projects that choose to participate receive these scans periodically at no cost. A key operational detail is that the resulting security reports are generated entirely by AI and are sent to the project maintainers without being reviewed by a human analyst first. This approach allows for rapid, scalable scanning but means the initial findings come directly from the model.

The background

The development of OSS Scanner is rooted in Anthropic’s own internal security practices. According to Anthropic, the service is informed by the company’s experience using its Claude AI model to find vulnerabilities during a previous initiative called Project Glasswing. By leveraging lessons learned from that internal effort, Anthropic is now extending this capability to the wider community. The goal is to provide thorough security checks to projects that might not have the resources for constant, high-level manual auditing.

What changes now

Open-source project maintainers now have access to a new, free tier of automated security scanning. For organizations relying on open-source components, this adds another layer of potential visibility into the security posture of the libraries they use, provided those projects opt in. The absence of human review in the reporting process shifts some responsibility to the recipients to validate the AI-generated findings. This model highlights a growing trend of using AI for continuous security monitoring, though it also underscores the need for careful handling of automated outputs.

What to do and how to stay safe: Anthropic

• Review the open-source components in your software supply chain to identify which critical projects have opted into OSS Scanner or similar automated auditing services.
• Establish a process for validating AI-generated security reports, ensuring that findings are verified by human analysts before prioritizing remediation efforts.
• Monitor communications from open-source maintainers for updates on security audits, as new scanning tools may reveal previously unknown vulnerabilities in widely used libraries.
• Evaluate your organization’s exposure to open-source software and consider whether participating in or supporting opt-in security programs aligns with your risk management strategy.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is OSS Scanner free to use?

Yes, Anthropic states that projects that join the service will receive thorough, periodic security scans at no cost.

Does a human review the vulnerability reports before they are sent?

No, according to Anthropic, the AI-generated reports are sent to projects without human review.

What experience led to the creation of OSS Scanner?

Anthropic said the service is informed by its experience using the Claude model to find vulnerabilities during Project Glasswing.