Anthropic launched OSS Scanner on October 8, 2026, a free opt-in service for eligible open-source projects that provides recurring vulnerability scans. Core maintainers can apply by submitting a pull request to the project’s GitHub repo, with Anthropic reviewing eligibility case by case.
According to the Anthropic launch post, reports are fully model-generated and may be sent without human review or triage. Anthropic says that speeds up scanning, but it can also produce incorrect or invalid findings.
In the company’s early validation, expert reviewers checked 97 critical or high-severity findings across 48 projects. Anthropic says 85 met the bar for its coordinated vulnerability disclosure process, while 11 more were real duplicates and one was invalid.
For teams building security workflows, OSS Scanner looks best used as an additional signal source rather than an automated decision-maker, since the reports arrive without analyst screening.