Anthropic launches 'OSS Scanner,' a free AI security scanning service for open

Anthropic has announced ' OSS Scanner ,' a service that offers free security scans using its 'highest-performing model' for open-source projects. An opt-in vulnerability-finding service for open-source software \ Anthropic

OSS Scanner is a service that performs security audits using 'the most powerful models, including Claude Mythos.' Unlike

Experts reviewing CVD (Collaborative Vulnerability Disclosure) findings checked 97 vulnerabilities detected across 48 projects, and found that 85 of them (88%) met the criteria of the CVD process. Of the remaining 12, 11 were real vulnerabilities but overlapped with known issues or other problems, and only one was a 'false positive.' When Anthropic sent these detection results to the actual maintainers, they found that very few of the high-severity or criticality detections were deemed invalid. Some maintainers did point out that the severity ratings were overestimated or that the scanner might be misinterpreting the project's threat model. Anthropic stated, 'We cannot guarantee that the OSS Scanner is perfect, but we will continue to improve the system based on feedback from maintainers and improvements to the model.' PostgreSQL and OpenSSL are among those participating in the initial testing. Noah Misch, a developer for PostgreSQL, commented, 'We found an unusually high percentage of bugs in PostgreSQL. Several reports included fixes that were almost ready to use. We were able to utilize a rapid delivery route, allowing us to address the latest issues before they reached the GA release.' OSS Scanner targets open-source projects that have a significant impact on infrastructure and user security, and eligibility for use is determined on a case-by-case basis. Key maintainers of target projects can apply for use by submitting a pull request to the repository listed below, following the prescribed template. GitHub - anthropics/oss-scanner · GitHub

OpenAI Announces Codex Security, an AI Agent for Automating Vulnerability Discovery, Verification, and Fixing

What is 'Know, Prevent, Fix' to increase the security of open source projects proposed by Google?

Cloudflare tests Anthropic's unreleased AI model 'Mythos': What capabilities did their vulnerability investigation reveal?

It was discovered that a malicious backdoor was installed in the built-in compression tool 'XZ Utils' of Linux distributions such as Red Hat and Debian.

A cURL developer points out that Claude Mythos's claim of having 'high vulnerability detection capabilities' is an exaggeration.

Pointed out that there is a flaw in the ``CVE'' system that assigns IDs to vulnerabilities and manages them

Google launches 'Android Bench,' an AI performance comparison service that ranks AI technologies based on their usefulness to Android development. Gemini tops the list for the first time.

Anthropic releases Claude Opus 4.1 with improved coding capabilities

Oct 09, 2026 12:13:00 in AI , Security , Posted by log1p_kr