Anthropic Launches Free AI Scanner for Open Source
Anthropic's Cyber Mission pairs a free vulnerability scanner for open source with a defense program for power, water and transport operators.
In short
Anthropic's free OSS-Scanner automatically checks enrolled open-source projects for vulnerabilities, explains what it finds and drafts patches, at an accuracy the company expects to exceed 90 percent — with reports going out without human review.
At a glance
- Cyber Mission has two parts: the OSS-Scanner and the Critical Infrastructure Defense Program (CIDP).
- Four CIDP founding partners: CrowdStrike, Palo Alto Networks, Deloitte and Rockwell Automation.
- Accuracy Anthropic expects: more than 90 percent; reports reach projects without human review.
- Opt-in only: maintainers enroll via GitHub if a project is critical to infrastructure or user safety.
Anthropic is handing open-source maintainers a free vulnerability scanner: the OSS-Scanner reviews enrolled projects, explains the weaknesses it finds and drafts a fix. The company expects it to be right more than 90 percent of the time, and every report goes out without a human checking it first.
Who maintains the code everyone depends on
Much of today's software rests on open-source libraries kept running by small, largely volunteer teams. The scanner is aimed squarely at that gap. It looks for security flaws, says in plain language what is wrong, and proposes a change the maintainer can accept or reject. Anthropic's stated reason for giving it away: attackers already run capable AI models, while defenders have little of equivalent strength.
The automation cuts both ways. Anthropic says the reports ship without human review and may contain errors, so each finding still needs a maintainer's judgment before it turns into a commit.
The other half of Cyber Mission
The scanner is one of two pieces in a long-term effort Anthropic calls Cyber Mission. The second is the Critical Infrastructure Defense Program, or CIDP, which offers operators of power grids, water systems and transportation networks access to Claude models, engineering support and threat analysis. Four founding partners are named: CrowdStrike, Palo Alto Networks, Deloitte and Rockwell Automation.
How maintainers get in
Enrollment is voluntary. Maintainers whose projects are critical to infrastructure or to user safety can sign their repositories up through GitHub, at no charge.
What the reporting does not establish
Several things stay open. The specific Claude version behind the scanner is not identified, and there are no figures for how many projects will be accepted or how long the service stays free. How the expected 90 percent accuracy was measured is also unstated, and no independent evaluation of that number is available. The per-operator scope of CIDP support remains unquantified as well.
FAQ
Is Anthropic's OSS-Scanner really free?
Yes. There is no fee, and maintainers opt their repositories in voluntarily through GitHub.
How accurate is Anthropic's AI vulnerability scanner?
Anthropic expects better than 90 percent accuracy. No independent evaluation of that figure has been published, and reports are sent without human review.
Which open-source projects qualify for the scanner?
Projects that are critical to infrastructure or to user safety. Anthropic has not said which Claude version powers the scans.
