Free recurring scans with its top model
Anthropic has launched "OSS Scanner," which uses the company's highest-performing AI model to scan critical open-source software for vulnerabilities, or flaws that can be exploited, for free and on a recurring basis. The company announced it on Oct. 8 and presented it again on Oct. 19 (Oct. 20 Japan time) through its official developer account @ClaudeDevs. Reports come with steps to reproduce the flaw and a proposed fix. The scans also use "Claude Mythos," the company's top model, which is not publicly available.
According to the company, OSS Scanner draws on its experience with "Project Glasswing," an effort to find and fix flaws in critical software with AI. To take part, a project's core developers apply by submitting a configuration file to Anthropic's public repository. Projects provide a definition of the environment in which the software is built, and scanning is done in an environment with no network connection. The company said it selects projects by criteria close to those of Google's "OSS-Fuzz."
No human review, with errors acknowledged
Scan reports are produced by AI without human review or triage. That allows faster and more frequent scanning, but Anthropic acknowledges that reports may be wrong. Because of the risk of false positives, it does not apply the common rule of disclosing after 90 days. For reports verified by people, it may disclose 90 days after notifying developers.
In testing so far, Anthropic has found more than 29,000 candidate vulnerabilities in major software and reported a little over 6,000 of them to developers. As of Oct. 2, 584 advisories had been issued. In a sample review of 97 high-severity cases, 85 met the company's disclosure criteria and one was invalid. The company expects the share that identify genuine flaws to exceed 90%.
| Stage | Count |
|---|---|
| Candidate vulnerabilities found | 29000 |
| Reported to developers | 6000 |
| Advisories (as of Oct. 2) | 584 |
Getting ahead of AI's growing offensive capability
As AI's ability to read programs improves, attackers are also getting faster at finding software flaws. Anthropic said it expects AI to work in defenders' favor in two years, and announced at the same time a plan to help defend critical infrastructure.
Other companies are moving in the same direction. OpenAI disclosed on Oct. 21 that it had found "php2shell," a serious open-source vulnerability, and spent two months addressing it with those involved. Anthropic itself also added a feature to its business offering "Claude Security" the same day that automatically rescans whenever code changes.
