Anthropic's October 8 announcement introduces OSS Scanner, an opt-in vulnerability-finding service for eligible open-source projects. Participating projects receive periodic scans at no cost. The service sends model-generated reports without human review or triage, rather than certifying that every reported issue is a valid vulnerability.
Anthropic says its broader scanning work found more than 29,000 candidate vulnerabilities over six months, while approximately 6,000 had been manually reviewed and triaged. Those are different stages of the process. The candidate total is not a count of confirmed flaws, and it is not a published tally of vulnerabilities fixed by maintainers.
In an early validation exercise, expert testers checked 97 critical or high-severity findings across 48 projects. Anthropic reports that 85 findings, or 88%, met its coordinated-disclosure standard. Of the other 12, 11 duplicated known issues or other scan findings and one was invalid. This is a vendor-reported sample, not a guarantee of the scanner's accuracy across all future projects.
The launch announcement says reports include a reproducer, an explanation and a candidate patch when available. Anthropic also acknowledges maintainer feedback about inflated severity ratings and misunderstood threat models. Maintainers still need to assess whether an issue applies to their software and whether a proposed fix is suitable.
Core maintainers can apply through the project's GitHub enrollment process. Eligibility is assessed case by case using criteria similar to OSS-Fuzz, including a project's impact on infrastructure and user security. The FAQ says the service is intended for projects already able to keep up with verified high- and critical-severity reports, rather than a promise that every repository will be accepted.
The optional fast track sits alongside Anthropic's existing human-verified coordinated vulnerability disclosure process. The FAQ says unvalidated scanner findings do not currently carry a mandatory 90-day disclosure period; a later human-validated report may enter the existing disclosure process. OSS Scanner is separate from the commercial Claude Security offering. The October 8 launch date should not be confused with later coverage on October 9.