Open-source projects can now receive security scans from Anthropic’s strongest models without paying for the service. The company has launched OSS Scanner, an opt-in vulnerability-finding service designed to search open-source software for weaknesses that could threaten the code supporting the internet.
Anthropic says participating projects will receive “thorough, periodic security scans by our strongest models at no cost.” That promise puts AI-driven security checks within reach of projects that may not have the budget, staff, or time for regular code reviews.
A Free Scanner Built for Open-Source Projects
OSS Scanner will use Anthropic’s strongest models to inspect participating open-source software projects. The reports will include results generated by models such as Claude Mythos, giving open-source maintainers an automated way to look for vulnerabilities across their code.
Anthropic says the goal is to give open-source projects “the largest defensive advantage.” The service follows the model of OSS-Fuzz, an open-source software scanner created by Google and the OpenSSF that has been available since 2016.
That connection matters because open-source code forms part of the foundation beneath the internet. Google and Anthropic rely heavily on open-source projects, many of which are maintained by unpaid workers. A free scanning service could give those projects access to a security resource that would otherwise be difficult to fund or sustain.
Anthropic has already introduced Claude Security, a paid product that can perform general-access code scanning and patching. OSS Scanner takes a different path by offering vulnerability scans to open-source projects at no cost.
Speed Comes With a Clear Warning
OSS Scanner will not include human review or human triage. Anthropic describes the output in direct terms: “The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage.”
That design allows the service to scan projects faster and more often, but it also creates a risk that a report may not hold up. Anthropic warns that “it is possible reports will be incorrect or invalid,” so project maintainers will need to assess the findings before treating them as confirmed vulnerabilities.
The tradeoff is easy to see. Human review can help separate real security problems from false alarms, but it also takes time and limits how many projects a team can examine. Model-generated reports remove that step, allowing OSS Scanner to deliver more frequent scans while placing responsibility for verification with the open-source project.
Anthropic says the reports will be generated by its strongest models, “including Claude Mythos.” The company presents those models as a way to increase the defensive value available to projects that join the service, even though every result will still require careful evaluation.
Why Open-Source Vulnerabilities Matter
Security flaws in open-source code can spread far beyond a single project. When widely used software contains a vulnerability, the problem can affect the systems and services that depend on it, creating risks across the internet.
The XZ Utils backdoor shows why these weaknesses demand attention. It stands as an example of how dangerous a security problem in open-source code can become, especially when projects support other software and services.
Open-source maintainers often work without the resources available to commercial software teams, yet their code can sit beneath critical parts of the digital world. OSS Scanner targets that gap with automated analysis from Anthropic’s strongest models and a price of zero for participating projects.
The service also raises a practical question: how much trust should teams place in an AI-generated security report? Anthropic’s warning provides the answer’s starting point. The scanner can expand access to vulnerability detection, but its findings are not human-reviewed and may be incorrect or invalid.
OSS Scanner therefore represents both a new security resource and a new responsibility for open-source projects. Faster, more frequent scans could help maintainers uncover problems sooner, while the lack of human triage means every report must be checked before action.
Anthropic launched the service on Oct. 9, 2026, at 7:24 am EST, following the company’s move to bring its strongest models into open-source security work. If the approach delivers on its promise, AI could help more projects search for vulnerabilities before those flaws become larger threats.
Based on
