Anthropic’s Free Open-Source Bug Scanner Skips the Human Review

Anthropic launched a free, opt-in service that scans open-source projects for security bugs with its strongest AI models and emails the findings to maintainers without a human check first.
artificial-intelligence
cyber-security
Author

Kabui, Charles

Published

2026-10-13

Keywords

anthropic, oss-scanner, open-source-security, vulnerability-scanning, cyber-mission, claude-mythos

Download as PDF

OSS Scanner is a free service from Anthropic that hunts for security bugs in open-source software and emails what it finds to the people who maintain that code. Maintainers opt in by opening a pull request on GitHub. Each report includes a working proof of concept, an explanation of the flaw, and a suggested fix. Every report is written by AI models, with no human checking it first. Anthropic built it after a similar scan during Project Glasswing, and says Google’s OSS-Fuzz inspired the design.

The reason for skipping the human check is volume. Anthropic’s models found over 29,000 candidate vulnerabilities in widely used software over six months, and its team could only manually review about 6,000. On CyberGym, a public test, the models went from finding under 20% of the vulnerabilities at the start of last year to over 85% this year. Finding bugs is now easier than checking them. Of the findings an outside security firm reviewed, 92.7% turned out to be real. The software library wolfSSL said 72 of the 74 reports it received were valid, and five became official security advisories.

Some of the unreviewed reports will be wrong, like an inflated severity rating, so Anthropic is not imposing a 90-day disclosure deadline by default. Anthropic frames the push as a race, since capable models are now widely available to attackers too. The same launch created a program to protect power grids, water systems and transport, with 11 partners including CrowdStrike, Palo Alto Networks and Rockwell Automation.

Read More: OpenAI Daybreak vs. Anthropic Mythos: two rival visions for AI cybersecurity

Sources:

Disclaimer: For information only. Accuracy or completeness not guaranteed. Illegal use prohibited. Not professional advice or solicitation. Read more: /terms-of-service

Reuse

GNU GENERAL PUBLIC LICENSE v3.0(View License)

Citation

BibTeX citation:
@misc{kabui2026,
  author = {{Kabui, Charles}},
  title = {Anthropic’s {Free} {Open-Source} {Bug} {Scanner} {Skips} the
    {Human} {Review}},
  date = {2026-10-13},
  url = {https://toknow.ai/posts/anthropic-oss-scanner-cyber-mission/},
  langid = {en-GB}
}
For attribution, please cite this work as:
Kabui, Charles. 2026. “Anthropic’s Free Open-Source Bug Scanner Skips the Human Review.” https://toknow.ai/posts/anthropic-oss-scanner-cyber-mission/.