Anthropic launches free AI security scans for open source projects

Artificial intelligence firm Anthropic introduced a free automated security scanning service for open-source software projects, aiming to address a widening bottleneck in vulnerability detection and remediation across the software supply chain. Released as part of a broader initiative called the Anthropic Cyber Mission, the new tool deploys the company's most advanced models — including Claude Mythos — to examine codebases and issue unreviewed reports directly to participating maintainers.

The announcement on Wednesday, 8 October 2026, follows months of intensive bug-hunting through earlier pilot programs. Over a six-month period, Anthropic models identified more than 29,000 candidate vulnerabilities in widely used software, but human specialists were only able to manually verify and prioritize about 6,000 of them, according to Incrypted. While some maintainers welcomed the rapid delivery of raw data, others requested every unreviewed finding, prompting Anthropic to build the standing scanner.

Media additions

Operating under an opt-in model inspired by Google's OSS-Fuzz, the scanner generates reports containing self-contained reproducers, explanations of affected code, code bisections showing when flaws were introduced, and candidate patches. However, because the reports bypass human screening, Anthropic warned that results may include false positives, duplicates, or inaccurate severity ratings, requiring maintainers to handle verification themselves.

The launch arrives alongside the Critical Infrastructure Defense Program, which pairs frontier Claude models and on-site engineers with eleven founding partners, such as Accenture, Booz Allen Hamilton, CrowdStrike, Deloitte, and Palo Alto Networks, to protect power grids, water systems, and transportation networks. Industrial operators often run control software for decades without taking systems offline for patches, creating long-lived vulnerabilities that require specialized security oversight.

Open-source maintainers seeking access must submit a pull request containing a configuration file to a dedicated GitHub repository. Eligibility is determined on a case-by-case basis using criteria similar to OSS-Fuzz, emphasizing a project's impact on infrastructure and user security. Projects lacking the staff to triage raw findings will continue receiving traditional, human-verified disclosures under Anthropic's coordinated vulnerability disclosure policy.

Funding for the free scanner is supported by the Defender Advantage Fund established in August, alongside contributions to foundational organizations such as the Python Software Foundation and the Apache Software Foundation, as reported by Resultsense. Concurrently, maintainers can apply for free Claude Max subscriptions through a separate initiative to assist with remediation.

Industry observers note that the rollout occurs as defenders grapple with the dual-use nature of generative technology. As detailed by Startupfortune, automated coding tools and language models have also been observed in research environments and intrusions targeting financial and government infrastructure, increasing the urgency for defensive deployments.

Over the coming months, Anthropic plans to expand the Critical Infrastructure Defense Program into additional sectors, onboard more partners, and refine its open-source scanning capabilities based on maintainer feedback.