Anthropic's OSS Scanner: What It Actually Does

Quick answer: Anthropic launched OSS Scanner on October 8, 2026, a free, opt-in service that runs Claude-based agents against open-source repositories to find security vulnerabilities, built by its Frontier Red Team and Safeguards Research team and informed by an internal vulnerability-research effort called Project Glasswing. Unlike Anthropic's existing coordinated vulnerability disclosure (CVD) process, which has a human review every report before a maintainer sees it, OSS Scanner sends findings straight from its strongest models with no human validation step, trading review time for speed. It's not open to every repository: eligibility is modeled on Google's OSS-Fuzz criteria and favors mature, widely used, security-critical infrastructure projects that already have a maintainer who can triage reports. Maintainers enroll by submitting a config file to a public GitHub repo, and can pause or fully opt out at any time.

Security scanning tools get announced constantly. This one is worth a closer look because of who's behind it, the trade-off it's explicitly built around, and how new it still is: Anthropic already updated the eligibility and scoping rules on October 13, just five days after launch.

Most automated vulnerability reports that reach open-source maintainers are noisy, more false positives than real bugs, which is exactly why Anthropic's existing disclosure process puts a human in the loop before anything gets sent. OSS Scanner removes that human step on purpose, for projects that have already shown they can handle the volume.

What Problem This Is Solving

Anthropic already runs a coordinated vulnerability disclosure (CVD) program: when Claude finds a bug while being used for security research, a person reviews the finding before a maintainer ever sees it. That review step exists for a good reason. An unreviewed automated scanner tends to bury real findings under false positives, and maintainers of small projects don't have the time to sort through them.

The trade-off is speed. Human review takes time, and by Anthropic's own count, over 6,000 CVD reports had gone through that process as of October 2026. OSS Scanner is the opt-in fast lane: for projects that enroll, findings go out directly from Anthropic's strongest models, unreviewed, as soon as the pipeline produces them.

How a Project Actually Enrolls

Enrollment isn't automatic or self-serve in the usual sense. A maintainer submits a pull request to github.com/anthropics/oss-scanner adding a projects/<project>/project.yaml file with three required fields: the repo, a primary contact, and a Dockerfile (network access is allowed during the build, but the scanning agent itself runs fully offline). A script called tools/validate.py checks the config before it's accepted.

Optional fields add flexibility: autoccs for additional contacts, a pgp key so report emails arrive encrypted (though supplying one means extra CCs aren't allowed on that thread), and a threat model file, by default at .oss-scanner/threatmodel.md, that can define scope, what counts as an adversarial input, a severity rubric, report format, patch guidance, and deduplication rules.

Once live, the pipeline runs agents that double-check a finding before it's reported, propose a patch, and write up a root cause, then bundles everything into an email to the maintainer. A maintainer who wants a break can add disabled: true to pause reports, or opt out entirely by deleting the projects/<project>/ folder. Attribution is optional but appreciated: a commit message might read "Discovered by Anthropic's OSS Scanner, as vulnerability ANT-2026-ABCD1234," using Anthropic's own vulnerability ID format. Feedback goes back by replying to a report email, or to [email protected] for anything else.

Not Every Project Gets In

This isn't open to any repository that wants free scanning. Eligibility is explicitly modeled on Google's OSS-Fuzz criteria: exposure to untrusted input, number of dependent projects and users, project age and update frequency, OpenSSF criticality score, license type, and general popularity signals like stars and forks. Anthropic says brand-new projects and most forks typically don't qualify, and the service is aimed squarely at projects that can already handle a stream of verified high and critical reports, not ones that would be overwhelmed by their first one.

Anthropic is also explicit that this isn't a fixed bar: acceptance is case-by-case, and the criteria may change as the program matures. How often an enrolled project actually gets rescanned depends on pipeline load and the project's popularity too, not a fixed schedule.

That's a deliberate filter, and a sensible one: skipping human review only makes sense if the receiving end is equipped to do its own triage.

The Disclosure Timeline Is Different Too

Anthropic's standard CVD process uses a 90-day coordinated disclosure window. OSS Scanner's unvalidated reports don't get that window by default, since nothing's been confirmed yet. If a report is later validated through the regular CVD process, the 90-day clock starts from when a human confirms it, not from when the automated report first went out. Anthropic also notes it may add disclosure periods to specific high-severity unvalidated reports later, with notice and an opt-out for enrolled projects.

What's Protecting the Pipeline Itself

A few details in the announcement are worth noting for exactly the audience that would be nervous about an AI agent getting broad access to their repo and infrastructure. The scanning agent runs fully offline, inside a hardened sandbox, even though the Dockerfile build step has network access. Reports are stored in an isolated, locked-down cloud project that only the security staff who need it can reach. Every sign-up gets a human review, including a check of the project's listed security contact. Eligibility is rechecked again before any results go out, and an automated harness confirms a report is actually about the enrolled project, not one of its dependencies, before it's sent.

Extra Support for Enrolled Maintainers

OSS Scanner isn't the only thing on offer. Maintainers of qualifying projects can also get "Claude for OSS," which provides free Claude Max 20x subscriptions, and access to the Cyber Verification Program for security professionals who meet its qualifying criteria. Neither is required to enroll in the scanner itself, but both are part of the same push to put more resources behind critical open-source infrastructure specifically.

Anthropic is also upfront that the service is still settling into its final shape: the reporting format may change and eventually move beyond email, and the whole program is explicitly framed as something that will keep improving as the underlying models do.

Final Thoughts

OSS Scanner is a narrow, deliberately gated service, not a general-purpose free scanner for any repository. That's a reasonable design choice: an unreviewed AI agent sending vulnerability reports is only safe to scale once there's confidence the finding is usually right and the receiving maintainer can handle the noise when it isn't.

The more interesting signal is the trend it represents, and how quickly it's already moving: a program that launched on October 8 had its eligibility rules revised by October 13. A major AI lab is now comfortable enough in its own model's judgment to skip human review for a defined category of security findings, and that bar is still actively being redrawn in public, in real time.

If you're not maintaining one of the relatively small number of projects this program is built for, the takeaway isn't that you're unprotected by comparison. It's that automated AI-assisted vulnerability scanning just moved from "research experiment" to "opt-in production service with real users," and the eligibility bar for who gets access to it is likely to keep expanding as the approach proves itself.