Anthropic offers open-source maintainers unreviewed AI security reports

Anthropic's October 8 announcement offers open-source projects periodic scans by its strongest models through OSS Scanner. Participation is optional. Reports arrive without human review or triage, so a finding may be incorrect or invalid. The company continues its separate process for disclosing human-verified vulnerabilities, including for projects unable to assess raw reports themselves.

The service FAQ makes participation conditional: core maintainers apply by pull request, a proposed repository change, and projects are assessed individually for their importance to infrastructure and user security. A human checks the applicant's maintainer identity and the project's security contact; eligibility is checked again before results are sent. An optional threat-model document can identify untrusted inputs, excluded code and the project's severity rubric. That helps explain what the scanner should examine, rather than leaving every boundary implicit.

The enrollment repository describes what happens after acceptance and merge: the project builds with network access, then scanning runs without Internet. Build failures are emailed to the primary contact. Findings include reproduction steps and a proposed patch when available. Contact addresses in the configuration are public, so maintainers should supply an address suitable for publication, such as a security alias.

MarkTechPost’s overview was published on October 25 by Michal Sutter. It summarizes Anthropic’s enrollment documentation and links to the project template. We treat this account as secondary coverage of the service.