Anthropic's post says expert penetration testers reviewed 97 critical and high-severity findings across 48 projects, and 85 of them met the bar for its coordinated vulnerability disclosure process.

The exact words it rests on

To validate an early version of OSS Scanner, we asked the expert penetration testers who review our CVD findings to check 97 critical and high-severity vulnerabilities from the scanner across 48 projects. Of these, 85 (88%) met the bar for our CVD process. Of the remaining 12, 11 were real but duplicated known issues or other findings from the scan, and only one was invalid

What the source said when we opened it, on 12 Oct 2026.

The source

An opt-in vulnerability-finding service for open-source software
Anthropic · 2026-10-08

Open the sourcearchived copy

Checked

Checked by the notis newsroom on 12 Oct 2026, against the source above.

The number in it

• 88% · OSS Scanner, other figure (share of 97 critical and high-severity findings that met Anthropic's CVD bar in expert review (Anthropic's own validation))

In the story

Anthropic's OSS Scanner writes vulnerability reports without human review 12 Oct 2026