Anthropic Launches OSS Scanner Sending Unreviewed AI Vulnerability Reports

Anthropic launches OSS Scanner, an opt-in service that sends model-generated vulnerability reports, with no human triage, to eligible open-source projects at no cost. Anthropic says six months of scanning produced over 29,000 candidate vulnerabilities, of which only about 6,000 were reviewed. In testing, 85 of 97 critical findings across 48 projects met its disclosure bar.

• Todd Ouska of wolfSSL says 72 of the 74 reports the project received were valid and five became CVEs.
• Anthropic says it sends nearly 5,000 unverified reports to maintainers who ask for everything the scanner has.
• Core maintainers enroll in OSS Scanner by submitting a pull request to a GitHub repository using a standard project template.