Anthropic launches free vulnerability scans for critical open-source projects

• Free, recurring scans are available to eligible open-source projects, with reproducers and candidate patches, according to Anthropic's announcement.
• Initial scans reported 77 critical and 803 high findings, all model-rated, in Anthropic's update.
• Enrollment is opt-in through Anthropic's maintainer application; the launch post says reports arrive without human review.

The curl exploit had roughly 23 bytes of payload storage to work with. The scanner's build recipe must fetch dependencies upfront because the audit agent will have no Internet access.

Anthropic launched OSS Scanner on October 8, drawing on its Project Glasswing vulnerability work. Its broader scanning effort had produced over 29,000 candidate vulnerabilities in six months, with roughly 6,000 manually reviewed, according to the launch post.

Nearly 5,000 unverified reports had already gone to maintainers who explicitly requested them. OSS Scanner formalizes that fast track, using Anthropic's strongest models, including Claude Mythos, without human review or triage.

Each report contains:

• A self-contained reproducer.
• An explanation of the vulnerability, with bisection to identify when it was introduced where possible.
• A candidate patch when available.

The runnable reproducer is the standout.

An early validation exercise covered 97 high/critical findings across 48 projects, according to Anthropic's published evaluation. Expert penetration testers found:

• 85 findings (88%) met the bar for Anthropic's coordinated vulnerability disclosure process.
• 11 findings were real but duplicated known issues or other findings from the scan.
• One finding was invalid.

Some maintainers reported inflated severity ratings or misunderstandings of their projects' threat models. At wolfSSL, Todd Ouska said all but two of 74 reports were valid, and five became CVEs, in the same announcement.

Daniel Stenberg, curl maintainer, credited OSS Scanner with finding a use-after-free he described as one of curl's worst vulnerabilities in recent years. The fix shipped in curl 8.23.0 on October 14, according to the security advisory.

• Trigger: During an HTTP/2 upload, a server sends RST_STREAM with reason HTTP_1_1_REQUIRED or REFUSED_STREAM.
• Failure: Cleanup leaves a dangling pointer to a freed struct Curl_easy; server-controlled data can subsequently occupy that memory and replace a function pointer.
• Impact: Remote code execution was demonstrated under tightly constrained conditions. Stenberg said a crash was the likelier outcome of an attempted attack, and curl rated the flaw High.

The team confirmed the September 15 report within hours and shortened its release cycle from eight weeks to six.

Core maintainers apply by adding a projects/<name>/ directory through a pull request to the enrollment repository. Anthropic prioritizes established projects with critical infrastructure and security impact; brand-new projects and forks without substantial differentiation typically do not qualify, according to its eligibility criteria.

The enrollment files are:

• project.yaml: Repository URL, primary security contact and configuration. The repository can live outside GitHub, and a #branch suffix can pin the branch.
• Dockerfile: Environment setup, dependencies and project build. It can live in the project's repository or alongside its enrollment configuration.
• threat_model.md: Optional project-specific instructions for the scanner.

The build runs online in an isolated VM before the VM moves to a network without Internet access. Findings arrive by email, initially as a bundle, with subsequent scans looking for newly introduced or previously missed vulnerabilities.

tools/validate.py checks enrollment metadata. tools/check <name> reproduces the build and opens an offline shell; its --qemu variant runs inside virtual machines arranged like the scanner's.

Anthropic has not committed to a fixed scan interval. Cadence can depend on pipeline load, project usage and other factors.

Maintainers can shape the audit through threat_model.md, rather than leave the agent to infer project policy. The scanner FAQ describes four kinds of guidance:

• Scope: Components to test, adversarial inputs and explicitly excluded areas.
• Severity: The project's own critical/high/medium/low rubric.
• Deliverables: Preferred report format, useful proofs of concept, and whether patches should be minimal demonstrations or merge-ready changes.
• Deduplication: How finely the scanner should distinguish related findings.

The file has no required format. When it lives in the project's repository, maintainers can change it between scans to alter subsequent reports.

During an incident, thdxr reported that models initially helped investigate, then began refusing. Access to Daybreak Blue improved the situation.

He later clarified that the application had been filed a few days earlier and approved the previous day, adding that nobody was refusing to help the team.

Overalls developer GeoffreyHuntley reported few findings while running Daybreak Blue audit loops and argued that improving models were producing increasingly secure code. He rejected equating zero findings with safety, and said he lacked the inference budget to compare security outcomes across programming languages.

For Anthropic's tools, the program FAQ points to a separate Cyber Verification Program offering advanced cyber capabilities and reduced blocking classifiers to qualifying security professionals. It also lists free Claude Max 20x subscriptions through Claude for OSS to support remediation.

Unvalidated OSS Scanner findings carry no mandatory 90-day disclosure deadline. Anthropic's disclosure policy says that if it later validates a report through its human-reviewed CVD program, a 90-day clock may begin when the maintainer is notified of that validation.

Maintainers can pause automated reports with disabled: true or withdraw by deleting their enrollment directory. Opting out restores delivery through Anthropic's standard CVD process only.