Anthropic Releases Free Claude Bug Scanner for Open Source

Anthropic has introduced OSS Scanner, a free service that runs its top-tier AI models, including Claude Mythos, against open-source repositories to flag software defects directly to maintainers. Originating from six months of research by Anthropic’s Frontier Red Team—which surfaced over 29,000 candidate bugs while humans triaged around 6,000—the program automates reports to bypass review bottlenecks. In its initial week, the tool generated 77 critical and 803 high-severity ratings.

Before opening the tool, Anthropic's penetration testers audited 97 high and critical findings across 48 projects, discovering that 85 (or 88%) met coordinated disclosure criteria, while 11 were duplicate reports. Early adopters report strong results. Out of 74 notifications delivered to wolfSSL, 72 were valid and five received CVE identifiers, while OpenSSL noted the AI output rivaled human analysis. Notably, curl creator Daniel Stenberg credited the tool with finding CVE-2026-92392, an HTTP/2 use-after-free bug patched in curl 8.23.0 on October 14, 2026, officially attributed to "Luna, with Claude (Anthropic)."

Maintainers enroll through a GitHub pull request to anthropics/oss-scanner by submitting a project.yaml file and a build Dockerfile. Scans run offline in hardened sandboxes, accompanied by optional threat_model.md files and GPG public keys for end-to-end encryption. Each report equips developers with automated reproducers, bisection commit identification, and suggested code patches. Unreviewed findings carry no publication deadlines; a standard 90-day disclosure clock begins only when Anthropic manually verifies a bug.

This expansion reflects massive gains on vulnerability benchmarks like CyberGym, where large language models surged from detecting under 20% of flaws in early 2025 to over 85% in 2026. For software practitioners, OSS Scanner offers deep automated auditing at scale, though it shifts the burden of deduplication, severity rating, and final triage onto open-source development teams.