Anthropic launches free AI vulnerability scanning for open source projects

[Sequence19]

Anthropic has launched OSS Scanner, a free, opt in service that runs regular security scans on open source projects, Engadget reports. The scans use Anthropic's strongest models, including Claude Mythos. Projects that sign up will receive thorough, periodic security scans at no cost. It is modelled on OSS-Fuzz, the free scanner that Google and the Open Source Security Foundation have run since 2016

There is one important caveat that Anthropic states openly. The outputs will be fully model generated, without human review or triage. That allows faster and more frequent scanning. But it also means some reports may be incorrect or invalid, so maintainers will need to check them carefully

Anthropic sells a paid product called Claude Security for general code scanning and patching. OSS Scanner is a free offering specifically for open source. Engadget points out that both Anthropic and Google rely heavily on open source code, much of it maintained by unpaid volunteers. Giving something back makes sense

The risks of under resourced open source projects are well known. Engadget mentions the XZ Utils backdoor, where an attacker spent years building trust in a small but critical project before slipping in malicious code. Many projects that underpin the internet are maintained by a handful of people in their spare time. Free security help could make a real difference

I think this is a positive move, with one worry. Volunteer maintainers are already stretched, and a flood of false positives could add to their workload. The opt in approach helps, since projects choose to take part. If the reports are mostly accurate, it could catch serious bugs before attackers do

Would you sign your open source project up for AI security scanning? And how should maintainers handle AI generated bug reports?

Anthropic now offers a free vulnerability-finding service for open-source software - Engadgetwww.engadget.com