New to this? Read it in simple words
- Anthropic will scan open-source software for security flaws for free.
- Reports go to the projects’ maintainers without a human check first.
- In a sample of 97 serious findings, Anthropic says 85 were real and new.
- A second programme helps 11 security firms protect power and water systems.
- Open source
- Software whose code anyone can read, use and change, often kept by volunteers.
- Maintainer
- A person who looks after an open-source project and decides which changes go in.
- Critical infrastructure
- Systems a country depends on, such as power, water and transport.
Open-source code runs inside most of the world’s software, and small teams of volunteers often look after it. On October 8, Anthropic launched a free service that scans some of these projects for security flaws.
What the scanner does
OSS Scanner runs regular automated security scans of open-source projects that have signed up. Each report includes a working proof of the flaw, an explanation and, when one is available, a candidate fix.
Anthropic says the service is modelled on Google’s OSS-Fuzz, a long-running free scanning service. Only core maintainers can enrol a project, with a request on GitHub, and Anthropic checks each maintainer by hand.
The scans are free for open-source projects. Anthropic says its Defender Advantage Fund pays for them.
How OSS Scanner reports reach projects that opt in, from Anthropic’s posts and reports by SiliconANGLE, SecurityWeek and Security Affairs.
No human check first
Reports for projects that opt in go to maintainers before anyone at Anthropic reviews them. Anthropic says some will be wrong, for example with the wrong severity. Projects that do not opt in still get reports that people have checked.
Anthropic says its models found more than 29,000 possible flaws in six months, and people reviewed about 6,000 of them. In a sample of 97 serious findings across 48 projects, 85 were real and new, 11 were real but already known, and 1 was false.
The wolfSSL project says 74 reports reached it, and all but two were valid. These figures come from Anthropic and its partners, and maintainers told Anthropic that some severity ratings were too high.
Help for critical systems
A second programme, the Critical Infrastructure Defense Program, gives Claude models, engineers and threat research to 11 security firms. They include CrowdStrike, Dragos, Palo Alto Networks and Rockwell Automation.
The firms will use them to find and fix flaws in the systems that run power, water, transport and factories. Anthropic gave no money figures, and it did not say who pays for the computing, SiliconANGLE reports, citing Axios.
Anthropic also announced grants to open-source groups, including the Python Software Foundation and the Apache Software Foundation, without amounts.
Sources
Every fact in this story comes from the sources below. Open them to check our work.
- 1Primary source · October 8, 2026An opt-in vulnerability-finding service for open-source software Anthropic
- 2
- 3
- 4Research · October 8, 2026Anthropic launches critical infrastructure program and free OSS Scanner for open source SiliconANGLE
- 5Research · October 9, 2026Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security SecurityWeek
- 6Research · October 9, 2026Claude Helps Secure Open Source as Anthropic Offers Free Vulnerability Scanning Security Affairs
What the services do comes from Anthropic and matches three security outlets; the accuracy figures are Anthropic’s own. Silicon AI News is written with Anthropic’s Claude models.
Anthropic launched a free AI scanner that sends maintainers proven flaws, though reports skip human review first. How we rate the mood