Anthropic’s free OSS Scanner uses its AI models, including Claude Mythos, to check participating open-source projects for vulnerabilities without human review.
Anthropic introduced OSS Scanner on October 8, 2026, offering open-source projects a way to receive recurring AI-generated vulnerability scans at no cost. Projects must opt in to participate; Anthropic describes the service as using its strongest models, including Claude Mythos.
The reports are produced entirely by models, with no human review or triage. That design allows scans to be conducted more frequently, but it also means findings may be incorrect or invalid. Projects receiving reports will therefore need to assess them rather than treat every alert as a confirmed vulnerability.
The service arrives as AI tools are being used to identify flaws in open-source software. The Verge cited the “Copy Fail” bug, which affected nearly every Linux distribution in May, as one recent example of a significant security issue found with AI assistance. At the same time, maintainers have raised concerns about the workload created by a surge of AI-generated bug reports, including Linus Torvalds and Google.
OSS Scanner’s offer combines broader access to automated scanning with a clear limitation: its reports do not include human validation. For maintainers, that distinction matters when deciding how to prioritize findings and spend time investigating them. Anthropic says the service is intended to help participating projects spot possible issues sooner, but the reports themselves remain leads to evaluate, not verified security findings.