Anthropic has launched an automated OSS Scanner service to identify vulnerabilities in open-source projects. The tool uses the Claude Mythos model to generate reports, including reproduction steps and potential patches, without human review. The service operates in isolated virtual machines and is available for projects that meet specific criteria regarding infrastructure and user security impact.
Data from Anthropic's dashboard as of October 2, 2026, covering the preceding six months, shows that models identified 29,439 potential vulnerabilities. Out of 6,157 reports sent to maintainers, 516 fixes have been implemented. The company notes that the number of patches is a lagging indicator, as fixing vulnerabilities is a time-consuming process for maintainers.
The process involves two channels: reports verified by external firms and direct reports sent to maintainers. Approximately 22% of reports undergo independent verification, while 78% are sent directly. Anthropic acknowledges that direct reports may contain false positives. External firms confirmed 92.7% of the vulnerabilities they reviewed, though this represents only about one-fifth of all candidates.
Maintainers from projects such as PostgreSQL, OpenSSL, wolfSSL, HotCRP, and curl have provided feedback on the reports. While some noted the high quality of the findings, others highlighted issues with inflated severity ratings or misunderstandings of project threat models. Anthropic's internal data shows that Claude's severity assessments matched external firms exactly in 83% of cases.
