Anthropic has launched OSS Scanner, a free automated security tool designed for open-source projects. The service utilizes the company's most advanced models, Claude Opus 5.5 and Claude Mythos, to perform regular code audits without human intervention.
The system generates reports that include a reproducible example, an explanation of the vulnerability, the specific commit where the error originated, and a suggested patch. These reports are delivered directly to developers, bypassing manual review processes.
During the testing phase, Anthropic validated 97 critical or high-severity findings across 48 projects. The results showed that 88% met coordinated disclosure standards, 12% were duplicates of known issues, and only one was a false positive.
The company's internal pipeline identified over 29,000 potential vulnerabilities in six months, though human testers could only process 6,000 of them. Maintainers of projects like curl and wolfSSL have already utilized the tool to identify and address security flaws.
Anthropic includes a liability disclaimer in its user agreement, capping potential damages at $1,000. The company warns that the AI may misjudge the severity of a vulnerability or provide patches that could potentially break existing code.
