Anthropic launches free OSS Scanner for open-source projects

Anthropic has released OSS Scanner, a service that offers periodic security scans at no cost to open-source projects that opt in. The scans are performed by the company's most powerful models, including one called Mythos, and the reports are generated entirely by the model without human review or triage. The trade-off: higher frequency and speed, but a real possibility of false or invalid findings.

According to the company, the goal is to give open projects the largest possible defensive edge. Removing human involvement allows more frequent scans than a small security team could manage, but the cost is an unknown noise level. False positives will have to be investigated and rejected by maintainers themselves, adding load to people already dealing with a flood of reports.

AI bug-hunting tools have already proven themselves in recent months. In May, automated analysis uncovered the "Copy Fail" bug that affected nearly every Linux distribution, demonstrating the potential of this approach. Anthropic is betting that its models — particularly Mythos, for which no public benchmarks have been released — will deliver broader coverage and higher accuracy than existing tools.

At the same time, the open-source community reports growing difficulty keeping up with the deluge of reports from automated tools. Linus Torvalds and Google were cited as examples of entities struggling with a flood of model-generated submissions, many of which turn out to be irrelevant or duplicates. OSS Scanner could worsen the problem if it lacks a filtering or credibility-ranking mechanism.

The announcement does not describe what the reports will actually look like — whether they will include precise code locations, proof-of-concept exploits, or CVSS severity ratings. It is also unclear how a project can mark a report as resolved or request a re-scan after a fix. Without those details, maintainers will have to learn the tool on the fly and decide whether the benefit outweighs the administrative cost.