Anthropic Launches Free AI Vulnerability Scanner for Open Source

Reports generated by OSS Scanner are sent directly to project maintainers without an initial human review. This approach aims to accelerate the discovery of vulnerabilities, though it shifts the triage work to the project teams.

As of October 19, Anthropic reported 77 critical and 803 high model-rated findings. The program has accepted 114 projects out of approximately 650 applications.

OSS Scanner runs on Anthropic's infrastructure at no cost to users. Maintainers provide a Dockerfile, and audits are conducted within an isolated virtual machine that has no internet access.

Of the 97 audited critical and high findings, 85% met Anthropic's disclosure criteria. The scanner demonstrated a low false positive rate, with only 1 of 97 audited findings being a false positive. For example, wolfSSL stated that 72 out of 74 reports were valid.

The design of OSS Scanner draws inspiration from Google's OSS-Fuzz, substituting fuzzers with language models to address review bottlenecks. Over a six-month period, Anthropic's models identified over 29,000 candidate vulnerabilities, with human reviewers triaging about 6,000.

The OSS Scanner program is an evolution of an ad hoc request system where nearly 5,000 additional reports were sent directly to maintainers who had requested all findings, regardless of validation.

To enroll, core maintainers submit a pull request to anthropics/oss-scanner, adding a project configuration file. This file requires repository details, a primary contact, and a Dockerfile path, with optional fields for threat models and encrypted reports.