Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security

What it is

OSS Scanner, Anthropic's free opt-in vulnerability-scanning service for open source projects, modeled on Google's OSS-Fuzz. It uses Anthropic's most capable Claude models to periodically scan projects maintainers have opted in, producing reports with a proof-of-concept exploit and, when available, a suggested fix.

How it works

Reports are model-generated and sent to maintainers without human review — this is the defining design choice. Anthropic built this after maintainers who could already triage findings at scale asked to receive everything the models found, including unreviewed output. Projects not opted into this unreviewed path still get Anthropic's standard human-verified coordinated vulnerability disclosure instead.

flowchart TD
    A[Project scanned by Claude] --> B{Maintainer opted into OSS Scanner?}
    B -->|Yes| C[Unreviewed report sent directly:<br/>PoC + possible fix]
    B -->|No| D[Standard coordinated disclosure:<br/>human-verified]

Preconditions / Affected

• Opt-in only — maintainers must explicitly enroll their project.
• Anthropic states the service is intended for projects with enough triage capacity to handle unreviewed findings at volume, not for all maintainers.

What to do

• Maintainers of actively-maintained OSS projects with spare triage capacity can opt in to get faster, pre-review access to Claude-identified vulnerabilities and PoCs.
• Expect a true-positive rate above 90%, per Anthropic's stated target — meaning up to roughly 1 in 10 reports may be inaccurate (e.g., wrong severity rating), so some manual filtering is still required even with opt-in.
• Projects that can't absorb unreviewed noise should rely on Anthropic's existing human-verified disclosure channel instead.

Caveats

Anthropic itself frames this as building on Project Glasswing, where many vulnerabilities were found but fixes often took months — the >90% true-positive figure is a target/expectation stated by Anthropic, not an independently verified measurement, and the page gives no data on report volume or false-positive handling in practice.