Anthropic OSS Scanner: free AI security scans hit your deps

Anthropic now runs free AI security scans for open-source projects, and the reports go to maintainers without a human checking them first. The service is called OSS Scanner, and it launched on October 8 as part of a wider Anthropic Cyber Mission. You will probably never enroll a project. But the libraries your store and your apps run on will, and that changes how fast you need to ship updates.

What actually happened: OSS Scanner and the Cyber Mission

Per Anthropic's announcement and the OSS Scanner page:

• Opt-in and free. Core maintainers enroll by opening a pull request on GitHub that adds a project.yaml file. The file gives the repo to clone, a primary contact, and a Dockerfile that builds the project so the agent can run offline.
• Model-generated, no human review. Each report includes a proof of concept, an explanation, and a suggested fix where one is available. Anthropic says some reports will be wrong, for example with an incorrect severity rating.
• No 90-day clock on raw findings. Unvalidated reports carry no coordinated disclosure deadline. If Anthropic later validates a finding through its normal process, a 90-day period can start.
• Selective. Anthropic will pick projects with criteria similar to Google's OSS-Fuzz: established code that handles untrusted input or has many dependents.

Help Net Security reports that penetration testers reviewed 97 high and critical findings from an early version across 48 projects. 85 met Anthropic's disclosure criteria, 11 were real but duplicates, and one was invalid. Anthropic's own page only states that it expects a true-positive rate above 90%.

The same mission includes a Critical Infrastructure Defense Program. It gives Claude models and on-site engineers to 11 founding partners that secure power, water, and transport systems, including CrowdStrike, Dragos, Palo Alto Networks, and Rockwell Automation.

Why it matters for your business

More bugs found means more patches shipped. When a model scans a popular parsing library every week, fixes come out faster. That is good news only if you install them. A Shopify app, a Next.js storefront, or a Python script that runs payroll exports all pull in hundreds of open-source packages. If you update those quarterly, you will run known-vulnerable code for months.

The gap between fix and exploit gets shorter. A public patch tells attackers where the bug was. The same AI tools that find bugs can read a diff. Plan for days between release and exploit, not months.

Automate the boring part. Turn on Dependabot or Renovate. Group minor updates into one weekly pull request. Run your tests on every one. Merge security updates first. This takes an afternoon to set up, and it is the cheapest security control a small team can buy.

Sources: Anthropic, Anthropic OSS Scanner, Help Net Security.