New Anthropic OSS Scanner Tool to Scan Open-source Repositories for Vulnerabilities

What happened?

Anthropic has introduced OSS Scanner, a free service that checks critical open-source repositories for security vulnerabilities and sends findings directly to project maintainers. The opt-in program uses the company’s strongest AI models to run repeated scans, giving developers a faster route to potential flaws without waiting for human review. According to Anthropic’s service overview, OSS Scanner builds on its work with Project Glasswing. The company says it had reviewed more than 6,000 vulnerability reports by October 2026 through its existing disclosure process.

Key details

• The scanner builds each project in an isolated virtual machine with network access, then removes Internet access before the security audit begins.
• Core maintainers apply via a pull request adding a project.yaml with repository URL and contact email; Anthropic manually verifies they are core maintainers.
• Eligibility targets established projects with broad use, remote attack exposure, and significant infrastructure security impact.
• An optional threat_model.md lets maintainers guide the scan by describing untrusted input entry points, out-of-scope components, severity ratings, and preferred report formats.

Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.