OSS Scanner
A free open-source security vulnerability scanning tool released by Anthropic. It uses AI models to automatically detect security vulnerabilities in open-source code and provides vulnerability descriptions, proof-of-concept demonstrations, and remediation recommendations.
Timeline (last 90 days)
Anthropic says its OSS Scanner's scans over the past six months produced more than 29,000 candidate vulnerabilities, of which about 6,000 underwent human review and triage.
Anthropic opened the public service OSS Scanner on October 8; its output vulnerability reports are entirely model-generated, with no human review or triage, the service is free and optional, inspired by Google's OSS-Fuzz, and maintainers register by submitting a pull request to anthropics/oss-scanner.
OSS Scanner is powered by Anthropic's strongest model.
OSS Scanner is opened on an opt-in basis, and scan results are delivered with an 'unreviewed' status.
OSS Scanner's enrollment process requires projects to submit an enrollment PR rather than fill out a web form.
Completing enrollment in the form of a PR usually adds a configuration file or marker to the repository.
It is recommended to view OSS Scanner as a supplementary signal rather than a replacement for security processes; handling model alerts first through automated filtering and then deciding whether to dig deeper manually can significantly lower triage costs.
OSS Scanner's scan report is labeled 'unreviewed', meaning the report has not undergone manual review.
Anthropic launched OSS Scanner for the open source community, providing free security vulnerability scanning services for eligible open source projects.
Over the past six months, Anthropic used its model to identify more than 29,000 suspected vulnerabilities in open-source code, but only approximately 6,000 have been manually reviewed; of 97 high-severity findings across 48 reviewed projects, 88% met the standard, with the true positive rate expected to exceed 90%.
All Facts (10)
Anthropic says its OSS Scanner's scans over the past six months produced more than 29,000 candidate vulnerabilities, of which about 6,000 underwent human review and triage.
50%UnverifiedOSS Scanner is powered by Anthropic's strongest model.
50%UnverifiedOSS Scanner is opened on an opt-in basis, and scan results are delivered with an 'unreviewed' status.
50%UnverifiedOSS Scanner's enrollment process requires projects to submit an enrollment PR rather than fill out a web form.
50%UnverifiedOSS Scanner's scan report is labeled 'unreviewed', meaning the report has not undergone manual review.
50%UnverifiedCompleting enrollment in the form of a PR usually adds a configuration file or marker to the repository.
50%UnverifiedIt is recommended to view OSS Scanner as a supplementary signal rather than a replacement for security processes; handling model alerts first through automated filtering and then deciding whether to dig deeper manually can significantly lower triage costs.
50%UnverifiedOver the past six months, Anthropic used its model to identify more than 29,000 suspected vulnerabilities in open-source code, but only approximately 6,000 have been manually reviewed; of 97 high-severity findings across 48 reviewed projects, 88% met the standard, with the true positive rate expected to exceed 90%.
50%UnverifiedAnthropic opened the public service OSS Scanner on October 8; its output vulnerability reports are entirely model-generated, with no human review or triage, the service is free and optional, inspired by Google's OSS-Fuzz, and maintainers register by submitting a pull request to anthropics/oss-scanner.
50%UnverifiedAnthropic launched OSS Scanner for the open source community, providing free security vulnerability scanning services for eligible open source projects.
50%