What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Anthropic has launched OSS Scanner, a free, opt-in vulnerability-scanning service for eligible open-source projects. It sends maintainers periodic reports generated by Anthropic’s models, but the fast-track reports are not reviewed by a human before delivery. Maintainers must be ready to assess and triage possible bugs, duplicates, and incorrect severity ratings. Projects that need human-reviewed findings can use Anthropic’s coordinated vulnerability disclosure process instead.
What Anthropic’s OSS Scanner does
Announced on October 8, 2026, OSS Scanner is intended for open-source projects Anthropic considers important to infrastructure and user security. Accepted projects receive periodic scans at no cost. Anthropic says its approach draws on work from Project Glasswing and uses a range of scanning harnesses and techniques, including experimental methods that consume more tokens. Anthropic’s launch announcement and the OSS Scanner documentation describe the service and its enrollment process.
As an Amazon Associate I earn from qualifying purchases.
A report may include an explanation of a suspected vulnerability, a self-contained reproducer or proof of concept, an estimate of when the issue was introduced, and a candidate patch when available. These are possible report elements, not guaranteed contents for every finding.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11The defining trade-off is speed versus review: OSS Scanner delivers model-generated reports without human review or triage. Anthropic’s established coordinated vulnerability disclosure (CVD) route includes human review before disclosure. OSS Scanner is an optional faster route for projects able to handle unverified findings; maintainers who cannot do that can continue using CVD.
#1 Best Overall
Who can apply and how enrollment works
Anthropic says the service is for core maintainers of projects it considers important to infrastructure and user security. Eligibility is assessed case by case, with criteria described as similar to OSS-Fuzz. The documentation says Anthropic manually validates that an applicant is a core maintainer, so OSS Scanner is not an open, automatic signup for any repository.
- Prepare a project configuration. A core maintainer opens a pull request to anthropics/oss-scanner adding
projects/<project>/project.yaml. - Provide project details. The configuration includes the repository and homepage, contact addresses, and a threat model. Maintainers can also specify a severity rubric and preferences for proof-of-concept and patch formatting.
- Supply a scan environment. The project provides a Dockerfile. Anthropic says it builds the image with network access, then runs the agent without internet access.
- Plan for report handling. Maintainers should be able to review findings and respond to possible errors, duplicates, or severity mismatches. The documentation also supports encrypted report email using a GPG public key; that configuration has a limitation on adding CC recipients.
Projects can pause or leave by changing or removing their configuration through a pull request. After opting out, they return to the standard CVD process.
Rank #2
Are OSS Scanner reports reviewed by a human?
No. Anthropic says OSS Scanner reports are fully model-generated and delivered without human review. The company warns that reports may be incorrect or have inaccurate severity ratings; maintainers have reported inflated severity and cases where a project’s threat model was misunderstood. A candidate patch or detailed reproducer can help investigation, but neither establishes that a finding is valid.
This makes the two reporting routes meaningfully different:
| Factor | OSS Scanner | Coordinated vulnerability disclosure |
|---|---|---|
| Cost to eligible projects | Free, according to Anthropic. | Not stated in the cited Anthropic materials. |
| Who can use it | Projects Anthropic accepts after case-by-case eligibility review; an applicant must be a core maintainer. | Anthropic says human-verified disclosures remain available; the cited materials do not specify eligibility criteria. |
| Human review before delivery | No; reports are model-generated and unreviewed. | Yes; findings are human-reviewed before disclosure. |
| Maintainer workload | Maintainers need capacity to triage unverified reports, including possible duplicates or errors. | Human review happens before disclosure, reducing the burden of sorting raw model output. |
| Report contents | May include an explanation, reproducer or proof of concept, introduction bisection when possible, and candidate patch when available. | Not stated in the cited Anthropic materials. |
| Pause or opt out | Yes, by changing or removing the project configuration through a pull request; the project returns to CVD. | Not stated in the cited Anthropic materials. |
What Anthropic’s accuracy figures do—and do not—show
Anthropic says penetration testers reviewed 97 critical- and high-severity findings from the early scanner across 48 projects. Of those, 85 met the bar for Anthropic’s CVD process. Of the other 12, Anthropic classified 11 as real but duplicate or overlapping findings and one as invalid. This is a selected early sample, not a guarantee that a future report will be correct or that every project will see the same results.
Anthropic separately says it expects a true-positive rate above 90% as part of its Cyber Mission announcement. That is a forward-looking company expectation, not the result of the 97-finding validation sample. The company also reports that its models went from finding under 20% of vulnerabilities at the beginning of the prior year to over 85% this year on CyberGym. That is Anthropic’s description of a benchmark, not a field-accuracy measurement for OSS Scanner.
Rank #4
Other company-reported figures describe scale rather than accuracy: Anthropic says it discovered over 29,000 candidate vulnerabilities over six months, manually reviewed or triaged approximately 6,000, and sent nearly 5,000 reports directly to maintainers who requested all findings, including unverified ones. These workload and disclosure counts do not independently establish the validity rate of reports sent through OSS Scanner.
What maintainers have said about early reports
Maintainer comments in Anthropic’s launch post illustrate both the potential usefulness of the reports and the fact that experiences vary by project:
Best Value
- Noah Misch of PostgreSQL said: “Several reports came with fixes we can use nearly as-is, and fast-track access let us address the newest issues before they reached a GA release.”
- Anton Arapov of OpenSSL Corporation said: “The reports we received from Anthropic, raw model output included, were as good and sometimes better than what we get from people.”
- Todd Ouska of wolfSSL said: “We found the signal from these reports high: of the 74 reports we received, all but two were valid, and five became CVEs.”
- Eddie Kohler of HotCRP said: “The bug reports were thorough and clear, with a strong understanding of HotCRP’s complex permission model and good bug prioritization.”
- Daniel Stenberg of curl said: “OSS Scanner has helped us find multiple issues in curl worthy of addressing, including one of the worst curl vulnerabilities reported in the last few years.”
These are project-specific testimonials reported by Anthropic, not a controlled comparison across all participating projects.
OSS Scanner is not Claude Security
OSS Scanner is a free service for accepted open-source projects, with model-generated reports sent without human review. Claude Security is a separate commercial code-scanning and patching product focused on enterprise systems. Anthropic describes Claude Security as using a verification pipeline, with suggested fixes requiring human approval. The products have different audiences and review processes; they should not be treated as the same service.
OSS Scanner is part of Anthropic’s broader Cyber Mission. A separate Critical Infrastructure Defense Program targets providers serving operational technology and critical infrastructure. Anthropic named Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation as founding partners. The announcement identifies them as program partners; it does not establish an affiliate or referral arrangement.
Free tools Windows power users keep installed
One-click scans. No signup required.
Anthropic also says maintainers can apply for free Claude Max subscriptions through Claude for Open Source and for expanded defensive capabilities through its Cyber Verification Program, subject to qualification. These are separate software and program benefits, not prerequisites stated for OSS Scanner enrollment.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
