Anthropic has introduced OSS Scanner, a free opt in vulnerability scanning service designed to strengthen the security of open source software projects using artificial intelligence. Announced as part of the company’s broader cybersecurity efforts, the new platform is intended to help project maintainers identify potential security weaknesses before they can be exploited. Built on insights gained during Project Glasswing, the service provides periodic automated security assessments using Anthropic’s most advanced AI models at no cost to participating projects. According to Anthropic, all vulnerability reports generated by OSS Scanner are created entirely by AI models without requiring manual review or triage, enabling organizations to receive security feedback more frequently and at greater scale. The initiative reflects the company’s growing focus on applying artificial intelligence to defensive cybersecurity rather than solely using traditional vulnerability assessment techniques.
Anthropic said project selection will initially follow criteria similar to Google’s OSS Fuzz program, although the eligibility process may evolve over time as the service expands. Open source project maintainers who wish to participate can enroll by submitting a pull request through the repository together with a YAML configuration file. The configuration includes details such as the source code repository, a primary contact email address, and the location of a Dockerfile used to prepare an isolated environment for security analysis. Anthropic explained that the Dockerfile enables its offline AI agent to install dependencies, build the application, and perform a comprehensive audit without requiring internet connectivity during the scanning process. Project maintainers may also include optional information such as additional notification contacts, a project homepage, GPG public keys for encrypted reporting, and threat modeling documentation that helps define testing priorities and vulnerability classifications. Projects can also suspend automated reporting if required by adjusting the provided configuration settings.
The company noted that more than 116 pull requests had already been submitted to join the program at the time of the announcement, reflecting early interest from the open source community. Unlike many coordinated vulnerability disclosure programs, Anthropic stated that OSS Scanner does not automatically enforce a 90 day disclosure timeline because AI generated findings may contain false positives that require further validation. Instead, only vulnerabilities that are later confirmed through Anthropic’s existing coordinated vulnerability disclosure process may become subject to a standard disclosure schedule. Anthropic believes this approach provides maintainers with greater flexibility while reducing unnecessary pressure created by automated reports. According to the company, its broader AI assisted vulnerability research has already identified more than 29,000 candidate vulnerabilities across widely used software projects, with over 6,000 issues reported directly to maintainers. Those efforts have contributed to 584 published security advisories as of October 2, 2026, demonstrating the increasing role of artificial intelligence in supporting software security.
The launch of OSS Scanner also aligns with Anthropic’s recently announced Critical Infrastructure Defense Program, which focuses on improving the resilience of critical infrastructure and open source software through advanced AI capabilities. As artificial intelligence continues to influence both defensive and offensive cybersecurity activities, Anthropic believes AI can help security teams discover software flaws earlier, accelerate remediation efforts, and improve secure software development practices. The company acknowledged that AI technologies are increasingly being used to automate elements of cyber operations, making it important for defenders to adopt equally capable security tools. Through initiatives such as OSS Scanner and its Cyber Mission program, Anthropic aims to provide developers and maintainers with practical resources that improve software quality while strengthening protection for widely used open source technologies. The company also expressed confidence that advances in AI will increasingly support secure software development by helping organizations detect vulnerabilities before software reaches production environments.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
