Anthropic has launched OSS Scanner, an opt-in service for open-source projects to receive periodic security scans from its strongest language models, including Claude Mythos, at no cost. This service aims to help projects find and address vulnerabilities faster, enhancing their security against potential threats.
Key facts
| Fact | Detail | The source says |
|---|---|---|
| Number of candidate vulnerabilities discovered | 29,000 | “We have discovered over 29,000 candidate vulnerabilities” |
| Number of manually reviewed vulnerabilities | 6,000 | “but have only been able to manually review and triage approximately 6,000 of these” |
| Models used for scanning | Claude Mythos | “These reports will be generated by our strongest models (including Claude Mythos)” |
What happened
Anthropic has introduced OSS Scanner, an opt-in service for open-source projects to receive periodic security scans from its strongest language models, including Claude Mythos, at no cost. This initiative is designed to help open-source projects find and address vulnerabilities more quickly, thereby improving their security posture against potential threats. The service is inspired by Google's OSS-Fuzz project, which uses fuzzers to scan open-source software for vulnerabilities. Anthropic's OSS Scanner will generate reports without human review, enabling faster and more frequent scanning, though it may result in incorrect or invalid reports. The company has discovered over 29,000 candidate vulnerabilities through its models, but is limited by its human capacity to validate these findings.
In the Fathom Layer index
- Claude — AI Models & Intelligence
What to weigh
- Reports may be incorrect or invalid due to lack of human review.
- The service is available at no cost to open-source projects.
FAQ
Is OSS Scanner available at no cost?
Yes, OSS Scanner provides security audits at no cost to open-source projects.
What models are used for scanning?
The reports will be generated by our strongest models (including Claude Mythos).
Will the reports be reviewed by humans?
The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage.
Source: Anthropic