Anthropic: OSS Scanner found 880 serious flaws in 11 days
The free service flagged 77 critical and 803 high-severity issues, including a high-severity curl bug that pushed curl to move its release forward.
Anthropic said its free OSS Scanner flagged 77 critical and 803 high-severity vulnerabilities in open-source software during its first 11 days of operation. The service uses top models such as Claude Mythos to review project code.
The tool is free for maintainers, with Anthropic covering all costs. Reports include reproduction code, explanations of the cause and, where possible, suggested patches. Anthropic notes that the reports are raw model output with no human review and may contain false positives.
In an initial validation of 97 critical and high findings across 48 projects, penetration testers found that 85, or 88%, met disclosure criteria, while one was a false positive. Some maintainers said the scanner sometimes overrates severity or misreads a project's threat model.
The curl finding
The scanner reported CVE-2026-92392 in curl, a use-after-free during HTTP/2 uploads when the server interrupts a stream. The flaw was fixed in curl 8.23.0, released on October 14. curl lead Daniel Stenberg rated it as one of curl's worst in a long time and only its third High severity since 2021. Remote code execution was demonstrated under specific conditions, but curl says those conditions are strict and the most likely result is a crash.
The report was filed on September 15 from a pre-release version of the scanner, and curl moved its release forward by two weeks. As of October 2, Anthropic had 29,439 candidates from its own model-based scanning but could only human-review 6,123, and had already sent nearly 5,000 unverified findings to maintainers who requested them. Scans run in an internet-isolated sandbox, with no 90-day disclosure deadline and no publication of reports.
Anthropic cited Google's OSS-Fuzz as a model, and its paid Claude Security product is already available for enterprises. Maintainers apply by adding a config file through a pull request to the anthropics/oss-scanner GitHub repository; about 650 applications were received and 114 projects were accepted after review.
Quick answers
What did Anthropic's OSS Scanner find in its first 11 days?
It flagged 77 critical and 803 high-severity issues, judged by AI models including Claude Mythos.
How do open-source maintainers apply for OSS Scanner?
They add a config file via a pull request to the anthropics/oss-scanner GitHub repository, and Anthropic verifies they are core maintainers.
Is OSS Scanner free?
Yes. It is free for maintainers, with Anthropic covering all costs.