Anthropic's free OSS Scanner lets its models hunt open-source bugs
Anthropic will scan open-source code for free with its strongest models and send fixes straight to maintainers, with no human review in between. For India's vast developer base, the stakes are real.
The News
Anthropic has begun offering free, automated security scans to open-source software projects through a new opt-in service called OSS Scanner, launched on 8 October 2026 as part of a wider "Cyber Mission".
Projects that sign up receive periodic reviews from what Anthropic calls its most capable models. Each report flags a suspected flaw, explains it, includes a proof of concept showing how it could be exploited, and proposes a fix where one exists. The design is loosely modelled on Google's OSS-Fuzz, the long-running bug-hunting effort for open code.
The twist is that no human sits in the loop. Anthropic says the outputs are fully model-generated and sent without review, so some will carry mistakes such as incorrect severity ratings. It expects a true-positive rate above 90 percent. The service grew out of Project Glasswing, under which Anthropic scanned hundreds of widely used open-source projects with humans triaging the findings first; some maintainers asked to see every machine-flagged issue directly, prompting this unfiltered version. Enrolment is at red.anthropic.com/oss-scanner, and the scans are kept free by Anthropic's Defender Advantage Fund, launched in August.
Why It Matters
The announcement lands on a familiar anxiety: the software supply chain rests on volunteer-maintained open code, and the people securing it are badly outnumbered. When the Log4Shell flaw tore through the Log4j library in December 2021, it showed how one obscure dependency could imperil millions of systems. Google's OSS-Fuzz, launched in 2016, has surfaced thousands of bugs since, proving automation helps but that triage capacity remains the bottleneck.
Anthropic's bet is that frontier models can now do first-pass hunting cheaply enough to hand maintainers a finished report, fix included. That is a real shift from tools that merely flag suspicious lines, and it reframes a safety debate: the capabilities that make models useful to attackers are being aimed, deliberately, at defence. The gamble is the missing human review, since a flood of plausible-but-wrong reports could swamp small projects rather than help them.
Indian Angle
For India the stakes are unusually direct. The country hosts one of the world's largest and fastest-growing developer populations on GitHub, and much of that work flows into open-source libraries that global firms rely on. A free scanning service lowers the security bar for precisely the cash-conscious maintainers and early-stage startups clustered in Bengaluru, Pune and Hyderabad.
It also brushes against regulation. CERT-In's 2022 directions already require Indian entities to report certain cyber incidents within six hours of noticing them. A steady stream of model-written vulnerability reports, some accurate and some not, raises a practical question of how maintainers and the firms consuming their code separate signal from noise fast enough to stay compliant.
Then there is the services industry. TCS, Infosys, Wipro and HCLTech build client systems atop sprawling open-source stacks, so a tool that hardens upstream libraries carries downstream value for India's export engine. Indian security teams will still want the 90 percent figure to hold up in practice before trusting unreviewed machine output in production pipelines.
FAQ
How much does OSS Scanner cost?
Nothing. Anthropic says the service is free, underwritten by its Defender Advantage Fund, which launched in August 2026 to support security pilots and keep the scanner free for the projects that take part.
Are the vulnerability reports checked by humans?
No. Anthropic has confirmed the reports are fully model-generated and sent without human review, so some may contain errors such as mistaken severity ratings. The company expects a true-positive rate above 90 percent.
Which projects can join?
The service is opt-in and aimed at projects able to keep up with a steady stream of findings. Other projects continue receiving human-verified disclosures under Anthropic's coordinated vulnerability disclosure policy.
Where can I read the original announcement?
The rollout and its no-human-review design were reported by The Verge, which covered the launch and its trade-offs in detail.
This story was reported by The Verge. Read the full original coverage at The Verge.