Anthropic on Thursday unveiled OSS Scanner, an opt-in service that gives eligible open-source projects free, periodic security scans from its strongest models, including Claude Mythos. The company says the service is informed by its Project Glasswing vulnerability research, and that outputs are fully model-generated with no human review or triage, enabling faster and more frequent scanning. Each report includes a self-contained reproducer, an explanation of the flaw, when it may have been introduced, and a candidate patch when available. The offering sits under the company's broader Cyber Mission alongside a Critical Infrastructure Defense Program.

Core maintainers apply by opening a pull request on the OSS Scanner GitHub repository with a YAML configuration that lists the git repository to clone, a primary contact email, and a Dockerfile that pre-installs dependencies and builds the project so an offline agent can audit it without internet access. Optional fields include CC'd emails, a GPG key for encrypted reports, a threat_model.md file, and a disabled flag to opt out. Anthropic says enrollment follows criteria similar to Google's OSS-Fuzz, targeting established projects with critical impact on infrastructure and user security; Tech My Money reports contact addresses appear in public configuration, so a security alias is recommended.

The AI-report deluge is a live pain point — TechRadar reported from the Open Source Summit that IBM expects roughly 66,000 unique vulnerability disclosures in 2026, that curl ended its HackerOne program over poorly researched and AI-generated submissions, and that Linus Torvalds called AI bug hunters' duplicates a problem for the Linux security mailing list. Free scanning can add work before it removes it.

Anthropic forecasts that in two years AI will favor defense — catching bugs before they ship and enabling fundamentally secure software — while conceding attackers hold the upper hand until then, according to The Register's coverage of the announcement. The parallel Critical Infrastructure Defense Program pairs Claude models and on-site engineers with partners including CrowdStrike, Palo Alto Networks, Deloitte and Rockwell Automation. Related efforts include a Cyber Verification Program for vetted security professionals and Claude for OSS, which gives free Claude Max 20x subscriptions for fixing vulnerabilities. As of writing, The Hacker News counted 116 pull requests already submitted to the enrollment repository.