Anthropic launches free AI security scans for open-source projects

Anthropic has unveiled OSS Scanner, a service meant to help open-source projects hunt down security vulnerabilities. It's opt-in, and projects that sign up will get what the company calls "thorough, periodic security scans by our strongest models at no cost."

The pitch is appealing: developers could be alerted to potential problems sooner. But there's a significant caveat.

Reports with no human in the loop

The scanner's outputs, Anthropic stresses, will be fully model-generated — without human review or triage. That enables faster and more frequent scanning, but it also means some reports may turn out to be incorrect or simply invalid. The reports will be produced by the company's most capable models, including Claude Mythos, to give open-source projects what Anthropic describes as the largest possible defensive advantage.

Not the first, not the only

OSS Scanner is far from the first AI bug-hunting helper around. In recent months such tools have surfaced serious flaws in open-source software — for instance the Copy Fail bug that hit nearly every Linux distribution in May.

There's a flip side, though. Some projects are already straining under a sudden flood of AI-generated bug reports — a complaint voiced by Linus Torvalds and even Google. Anthropic's new service, promising still more frequent automated scans, risks adding to that flood rather than easing it.

Source: The Verge