Anthropic’s bid to help open source projects track security vulnerabilities with a new service called OSS Scanner. It says that open source projects that choose to participate will receive “regular and thorough security scans by our most powerful models at no cost.” That could mean open source projects are alerted about potential security issues sooner, but the downside is that OSS Scanner reports don’t include human review:
The results of this optional vulnerability scanner will be generated entirely by models, without human review or classification. This will allow for faster and more frequent scanning, but means that reports may be incorrect or invalid. These reports will be generated by our most robust models (including Claude Mythos) to give open source projects the greatest defensive advantage.
OSS Scanner is far from the first AI bug finding helper out there. AI tools have helped find some major security flaws in open source software in recent months, such as the “Copy Fail” bug that affected nearly all Linux distributions in May. At the same time, some open source projects are struggling to keep up with the sudden avalanche of AI-generated bug reports, including Linus Torvalds and even Google.
