Anthropic Opens OSS Scanner for Critical Open-Source Projects
Anthropic's OSS Scanner is a free, opt-in service that gives eligible open-source repositories periodic security scans using its strongest models. Core maintainers apply through a pull request to the scanner's repository; reports are model-generated, sent without human review, and may include candidate patches. Anthropic says projects are selected case by case, and some findings may be false positives.
Anthropic's OSS Scanner is a free, opt-in security-scanning service for eligible open-source projects. The company announced it on October 8, 2026; participating projects receive periodic scans from Anthropic's strongest models, while maintainers receive reports without human review. (Anthropic's launch announcement; OSS Scanner documentation)
Key Takeaways
- The service targets eligible open-source projects. Anthropic uses criteria similar to OSS-Fuzz, focusing on critical impact to infrastructure and user security. (Anthropic's OSS Scanner criteria)
- Scans are free, opt-in, and periodic. Anthropic does not state a fixed scan interval; cadence may depend on the project pipeline and usage. (Anthropic's service page)
- Core maintainers apply by pull request. The official repository provides a project template and asks maintainers to configure the repository, a primary contact, and a Dockerfile. (Anthropic's enrollment repository)
- Reports are model-generated, not human-reviewed before delivery. They may include explanations and candidate patches, but maintainers should validate findings. (Anthropic's launch announcement)
- The setup is for teams prepared to triage findings. Anthropic warns that automated reports can contain false positives. (Anthropic's OSS Scanner limitations)
How OSS Scanner Works
Anthropic says OSS Scanner provides thorough, periodic security scans at no cost to participating projects. The service was informed by the company's experience using Claude to find vulnerabilities during Project Glasswing; reports are sent to maintainers as the scans complete, without prior human review. Treat each report as a lead that the project team must assess, not as a confirmed defect. (Anthropic's launch announcement)
Reports explain potential findings and can include a candidate patch when one is available. Because the results are unvalidated and may be wrong, the service is best treated as another source of leads for a project's normal security and maintainer review, not as confirmation that a vulnerability exists. (Anthropic's OSS Scanner documentation)
Who Can Apply
Anthropic says the service is intended for established projects with critical impact on infrastructure and user security. It considers factors such as exposure to remote attacks, the number of users and dependent projects, project activity, and security criticality; each request is reviewed case by case. A public repository alone does not guarantee acceptance, so maintainers should explain the project's security importance in the application. (Anthropic's eligibility criteria)
The application flow is aimed at a project's core maintainers. Applicants open a pull request in Anthropic's public repository, add a project configuration, and identify the repository and a primary contact. The repository also requires a Dockerfile that prepares and builds the project so the scanner can run its audit in a restricted environment. (Anthropic's enrollment instructions)
Before applying, review the repository's publication notes. Anthropic says contact addresses in the project configuration are public, so maintainers should use an address suitable for publication, such as a security alias. (Anthropic's OSS Scanner repository)
What Maintainers Should Expect
Scans are periodic rather than tied to a published calendar. Anthropic says the interval may depend on the number of projects in the pipeline and how widely a project is used, so maintainers should not treat enrollment as a promise of a particular scan date. Keep existing security triage and disclosure workflows in place while using the service as an additional source of reports. (Anthropic's OSS Scanner documentation)
The key trade-off is speed versus validation: the service sends model-generated reports without a human review step, so participating teams need capacity to assess the findings and decide whether any proposed change is appropriate. Anthropic says it may refine the service and its reporting format over time. (Anthropic's launch announcement; OSS Scanner documentation)
How It Differs From Claude Code Review
Anthropic's Claude Code Review general availability update covers pull-request review for Claude Team and Enterprise organizations. OSS Scanner is a separate program for eligible open-source projects that opt in through Anthropic's repository; it is not the same GitHub workflow or audience. Both use code-review concepts, but their intended participants and enrollment paths differ. (Anthropic's OSS Scanner announcement; Claude Code Review announcement)
Sources
- Anthropic, An opt-in vulnerability-finding service for open-source software (October 8, 2026)
- Anthropic Frontier Red Team, OSS Scanner
- Anthropic, OSS Scanner repository and enrollment guide
- Anthropic, Claude Code Review is now generally available
Read next
Related coverage
Frequently Asked Questions
What is Anthropic's OSS Scanner?
OSS Scanner is a free, opt-in service that runs periodic security scans on eligible open-source repositories with Anthropic's strongest models. Anthropic says it was informed by its experience using Claude to find vulnerabilities during Project Glasswing.
Who can apply to OSS Scanner?
Core maintainers of open-source projects can apply. Anthropic uses criteria similar to OSS-Fuzz, focusing on projects with critical impact on infrastructure and user security, and reviews requests case by case. A project is not guaranteed acceptance.
Are OSS Scanner reports reviewed by people?
No. Anthropic says reports are model-generated and sent without human review. They can include an explanation and a candidate patch when available, but findings may be false positives and should be validated by maintainers.
How often does OSS Scanner scan a project?
Anthropic describes scans as periodic, but does not promise a fixed interval. Its documentation says the cadence can depend on the number of enrolled projects and how widely each project is used.
How does a maintainer apply?
A core maintainer opens a pull request to Anthropic's OSS Scanner repository with a project directory and configuration. The repository asks applicants to provide a Git repository, a primary contact, and a Dockerfile that prepares the project for scanning.