Anthropic launched OSS Scanner on 8 October, an opt-in service for open-source maintainers, and says its reports are fully model-generated, without human review or triage.
- Anthropic says each report includes a self-contained reproducer and an explanation, plus a bisection and a candidate patch where possible, and that the outputs are fully model-generated.
- Anthropic says expert penetration testers reviewed 97 critical and high-severity findings across 48 projects, and 85 of them met the bar for its coordinated vulnerability disclosure process.
- Anthropic's disclosure dashboard, which counts findings from all Claude models, lists 6,157 reported to maintainers as of 2 October; 4,824 were reported direct by Anthropic and may contain false positives.
Anthropic says the scanner's reports are written by a model and not reviewed by a person. For a maintainer, a report is therefore a lead to check, even though Anthropic's testers found that 85 of 97 sampled critical and high-severity findings met its disclosure bar. The dashboard figures cover Claude models in general, so they do not show how OSS Scanner itself performs. If you maintain an open-source project, read the enrolment steps before opting in and decide who will triage incoming reports. If you depend on open-source packages, ask your suppliers how they handle machine-written reports. Read on →
