Anthropic has opened a new route for open-source maintainers to get help finding software vulnerabilities. OSS Scanner is an opt-in service offering periodic AI-assisted security scans at no cost to eligible open-source projects. It launched October 8 as one part of the company's wider Cyber Mission.
The second part of that mission targets critical infrastructure, including the technology used to operate power, water and transport systems. The two programs share a defensive ambition, but they serve very different teams and should not be treated as one generic free security product.
What OSS Scanner is meant to do
Anthropic says enrolled open-source projects will receive recurring vulnerability assessments using its most capable models. The company positions the service as a way to help maintainers spot problems in software that forms part of the broader supply chain.
That is a substantial promise for projects with limited maintainer time, but a scan is not the same thing as a fully verified fix. Reports need triage, reproducible evidence and sensible disclosure handling; security researchers and maintainers still have to decide what to change and how to release it.
The companion research announcement calls OSS Scanner an opt-in service and draws on Anthropic's experience using Claude models to look for vulnerabilities during Project Glasswing. The service is described as free for participating projects, not as a blanket guarantee that every public repository will be continuously scanned by default.
Anthropic also says it will retain human-verified coordinated vulnerability disclosures for projects that cannot keep up with a stream of new findings. That distinction recognises a familiar maintenance problem: being told about a security flaw does not automatically provide the people or time to repair it.
A separate effort for physical infrastructure
The Critical Infrastructure Defense Program is pitched at trusted specialists defending operational technology. These systems include industrial controllers and long-lived equipment that cannot always be patched like a consumer laptop.
Anthropic says its program combines Claude models with engineering support and threat research to help those defenders identify risks. The model's role here is advisory to skilled teams working within operational constraints, not permission to experiment on live utilities or bypass safety procedures.
Anthropic has not demonstrated a universally reliable detection rate for operational infrastructure. Its published OSS Scanner evaluation concerns a different, selected sample and cannot stand in for independent field testing of critical systems. Results, false positives and the quality of proposed fixes will have to be assessed as the program develops.
The important part is follow-through
Anthropic's Cyber Mission also builds on its expanded Cyber Verification Program and partnerships with organisations supporting commonly used open-source software. It says it wants to speed up reporting, triage and fixes over time.
There are reasons to be interested and reasons to stay cautious. Automated analysis could help a small project find issues that would otherwise go unnoticed. It could also create extra work if reports lack context or overwhelm volunteers with urgent-looking claims that do not reproduce.
The original announcement is careful to describe future expansion rather than claim the whole ecosystem is already covered. Maintainers should check the published eligibility and enrolment information before planning their security processes around the service.
For developers, the immediate news is concrete: a free, opt-in scanner now exists, and Anthropic is offering another defensive program for a separate high-stakes audience. Whether those efforts measurably improve real-world security will depend on accurate findings, responsible disclosure and fixes that actually land.
Reporting notes