Anthropic uses top AI models to scan open-source code for free security fixes

Anthropic has introduced a new service called OSS Scanner, designed to help open-source software projects identify security vulnerabilities. According to reports from The Verge and Help Net Security, the company is offering these scans for free to projects that choose to opt in. The service leverages Anthropic's strongest AI models to provide thorough, periodic reviews of codebases, aiming to alert maintainers to potential security issues earlier in the development lifecycle.

In plain English

Open-source software powers much of the modern internet, but maintaining its security is a constant challenge for developers. OSS Scanner acts as an automated security reviewer. Instead of waiting for a researcher to manually audit the code or for a vulnerability to be discovered in the wild, the AI scans the software regularly. When it finds something that looks like a security flaw, it generates a report. This report explains what the suspected issue is, provides instructions on how to reproduce the problem, and suggests how to fix it if a solution is available. The goal is to reduce the time between a vulnerability being created and it being addressed.

The background

This initiative builds on Anthropic's previous work in software security research, specifically a project known as Project Glasswing. According to Help Net Security, Project Glasswing utilized Claude, Anthropic's AI model, to discover software vulnerabilities. Through this experience, Anthropic identified a significant operational hurdle: human validation.

While AI can quickly identify potential issues, confirming whether those issues are real vulnerabilities and determining their severity requires human expertise. This manual verification process has become a bottleneck in vulnerability research. By launching OSS Scanner, Anthropic is scaling this capability to help the broader open-source community, moving beyond internal research to provide a direct service to maintainers.

What changes now

For open-source maintainers, the immediate change is the availability of a new, free resource for security auditing. Projects must actively opt in to receive these scans. Once enrolled, they will receive periodic reports detailing suspected flaws. This could lead to faster remediation of security issues in popular open-source libraries, potentially reducing the risk of exploitation for downstream users. However, the service relies on the AI's ability to accurately identify vulnerabilities, and the reports are described as explaining "suspected" flaws, implying that human review of the findings remains a necessary step for maintainers to confirm and prioritize fixes.

What to do and how to stay safe: Anthropic

• Open-source maintainers should evaluate whether their projects would benefit from automated, periodic security scanning and consider opting in if the service aligns with their maintenance capacity.
• Organizations relying on open-source software should monitor announcements from the maintainers of their dependencies regarding new security tools or audit results.
• Security teams should continue to treat AI-generated vulnerability reports as leads requiring human verification before prioritizing remediation efforts.
• Developers should ensure they have processes in place to review and act on external security reports, regardless of the source, to maintain a robust security posture.

Step-by-step guide: Automatic Updates Mistakes That Leave Systems Exposed

General security guidance from the RedTeam Monitor newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is OSS Scanner available for commercial software?

According to the source material, OSS Scanner is specifically designed for open-source projects that opt in.

Who pays for the security scans?

Anthropic provides the scans at no cost to the participating open-source projects.

Does the AI fix the vulnerabilities automatically?

No, the service provides reports explaining how to reproduce the flaws and, when available, how to fix them, but maintainers must implement the fixes.