- Book: Prompt Engineering Pocket Guide
- Also by me: Thinking in Go (2-book series) — Complete Guide to Go Programming + Hexagonal Architecture in Go
- My project: Hermes IDE | GitHub — an IDE for developers who ship with Claude Code and other AI coding tools
- Me: xgabriel.com | GitHub
Anthropic will scan your open-source project for security bugs at no cost. The catch is written into its own announcement: the reports "are model-generated and sent without human review".
The service is called OSS Scanner. Anthropic announced it on October 8, and on October 19 the company's ClaudeDevs account announced it to developers on X. Anthropic's Cyber Mission announcement says enrolled projects get periodic scans from Anthropic's most capable models, "free of charge". The launch post names Claude Mythos among those models.
If you maintain a project that might qualify, look closely at the three files the scanner reads. One of them decides how loud the reports will be.
What lands in your inbox
Per the repository README, the scanner builds your project in an isolated VM, analyzes it with no Internet access, and emails what it finds to your primary_contact and any CCs. Each report carries a reproducer and, where available, a proposed patch. The launch post adds an explanation of the bug and, where possible, a bisection to the commit that introduced it.
Because no human checks these reports, Anthropic puts no 90-day disclosure clock on them, and the README says it "will not make them public". A clock only starts if a finding is later validated through Anthropic's coordinated disclosure process. Per the FAQ, it may then be disclosed 90 days after you are told about the human validation. The FAQ also says Anthropic may later set a disclosure period on some high-severity reports, with advance notice and an opt-out.
On the data side, the FAQ says the scanning agents run in hardened sandboxes with internet access disabled, and that reports sit in an isolated cloud project only the Anthropic security staff who need them can reach.
How good are unreviewed reports?
Anthropic publishes its own numbers, and they are worth reading as exactly that. Over six months its models produced more than 29,000 candidate vulnerabilities. Its team manually reviewed and triaged about 6,000, and it sent nearly 5,000 reports, unvalidated ones included, to maintainers who asked for everything (Anthropic).
To check accuracy, Anthropic's penetration testers reviewed 97 critical and high-severity findings across 48 projects. 85 of them (88%) met the bar for its disclosure process. Of the other 12, 11 were real bugs that duplicated known issues or other findings from the scan, and one was a false positive (Anthropic). Anthropic ran that check itself, on an early version of the scanner, so treat 88% as a vendor figure, not an independent audit. Security Affairs repeated the figures on October 9.
The maintainers quoted in the launch post are positive. The wolfSSL quote: "of the 74 reports we received, all but two were valid, and five became CVEs." The OpenSSL Corporation quote says a report with a real exploit attached is "basically job done for an engineer".
The same post also says some maintainers found severity ratings inflated, or felt the scanner misread their threat model. The Cyber Mission announcement says some reports will carry a wrong severity, and that Anthropic expects a "true-positive rate above 90%".
Enrolling is a pull request with three files
Core maintainers enroll by opening a PR to anthropics/oss-scanner that adds one directory, projects/<name>. Per the FAQ, eligibility follows criteria similar to Google's OSS-Fuzz: project age and update frequency, OpenSSF criticality score, an open-source license, usage, and the sectors the project serves. The FAQ adds that brand-new projects typically don't qualify, and that a human checks you are a core maintainer and that the contact is a genuine project security contact, for example one listed in SECURITY.md.
Here is a project.yaml adapted from the template, for a hypothetical library:
# projects/libexample/project.yaml
repo: https://github.com/example/libexample#main
primary_contact: security@example.com
homepage: https://example.com
disabled: false
dockerfile: .oss-scanner/Dockerfile
threat_model: .oss-scanner/threat_model.md
Use a security alias for primary_contact: the README warns that email addresses in project.yaml are public. If you add a pgp key, the template says every report is encrypted to it and goes to primary_contact only, so pgp can't be combined with auto_ccs.
In the Dockerfile, the network exists only while the image builds. The Dockerfile template says everything an agent might need to run your tests must be fetched there. The template also copies your checkout to /src and builds with debug info and frame pointers.
Before you open the PR, the README asks you to run two checks from the repo root: tools/validate.py checks your projects/<name>/ directory against the rules, and tools/check <name> builds the project the way the scanner will, then opens a shell in the finished image with no network. Work from your own fork, since the PR comes from there.
# your fork of anthropics/oss-scanner
git clone https://github.com/YOUR-USER/oss-scanner
cd oss-scanner
mkdir -p projects/libexample
cp templates/project.yaml projects/libexample/
# edit projects/libexample/project.yaml, then:
tools/validate.py
tools/check libexample
tools/check runs your Dockerfile with network access, as docker build would, and installs Claude Code into the image it builds, as the scanner does. The README tells you to check only projects you trust, so read the Dockerfile before you run it.
Write the threat model before the first scan
threat_model.md is optional, and the README calls it strongly recommended. It is the file that tells the scanner how you rate severity, for example whether post-auth SQL injection counts as high or critical for your project. Inflated severity is the complaint Anthropic itself reports, so this is the file to write first.
The template has five sections. A filled-in version for a hypothetical image decoder:
Threat model
============
What this project does and where untrusted input enters
-------------------------------------------------------
* An image decoder. Every input file is untrusted.
Components that matter most / least
-----------------------------------
* src/decode/ matters most. tools/ is a CLI wrapper.
* vendor/ is third-party code and out of scope.
How to exercise it
------------------
* examples/decode_file reads one file from argv.
How you rate severity
---------------------
* Any out-of-bounds write is high at minimum.
* Controlled overflow that may lead to RCE is critical.
* All DoS is medium.
Anything to leave alone
-----------------------
* Slow decoding of huge images is expected.
You are writing instructions for a model here. Name what is in scope and how to run your code, and list the cases you don't want reported. Leave it vague and you get the scanner's own idea of severity, unfiltered, in your inbox.
Pausing, leaving, and whether to enroll at all
To pause reports, set disabled: true. To leave, delete projects/<name>/. After you opt out, the FAQ says you go back to Anthropic's standard disclosure process.
Credit is not required. If you patch a finding, the FAQ asks for a line naming the report ID, in a format like ANT-2026-ABCD1234.
If your project lacks the people to triage a stream of model-written reports, wait. The Cyber Mission announcement says the service "is meant for projects with the capacity to keep up with surfaced findings", and that projects without that capacity keep getting human-verified disclosures. For the patching work, Anthropic also offers qualifying projects six months of free Claude Max 20x through Claude for OSS.
Would you enroll a project you maintain, knowing the first human to read each report is you? Tell me in the comments.
If this was useful
I build Hermes IDE, so weigh this with that in mind: if you hand a scanner report to Claude Code or Codex to reproduce and patch, Hermes can give each task its own branch and worktree, so the fix stays apart from your other work. It's free on macOS, Windows and Linux: download it or read the source on GitHub.
The scanner reads threat_model.md to decide what matters and how loudly to report it, so the way you write that file shapes what lands in your inbox. The Prompt Engineering Pocket Guide covers writing instructions like that, so a model does what you meant.
Top comments (0)