The opt-in scanner will use the company’s strongest AI models to check open-source projects for vulnerabilities, but reports will be model-generated and not human-reviewed.
Anthropic has released OSS Scanner, a tool that lets open-source projects check their code for security vulnerabilities.
“Projects that join will receive thorough, periodic security scans by our strongest models at no cost,” the company announced.
The launch comes after recent demonstrations that AI models are good at finding and exploiting vulnerabilities. The scanner could give open-source developers free early alerts about possible security issues. However, humans will not review the reports.
“The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage,” Anthropic explained. “This will enable faster and more frequent scanning, but means that it is possible reports will be incorrect or invalid. These reports will be generated by our strongest models (including Claude Mythos) to give open-source projects the largest defensive advantage.”
Anthropic said OSS-Fuzz inspired the project. Google and the Open Source Security Foundation (OpenSSF) created that scanner, which has been available since 2016.
Anthropic already sells Claude Security, a paid product that scans code for vulnerabilities and patches them. OSS Scanner runs similar security audits for free.
Google and Anthropic have self-interested reasons for offering these tools. Both companies depend heavily on open-source projects that hold up much of the internet, many of them run by unpaid volunteers. Flaws in that code can do serious damage. The XZ Utils backdoor, discovered recently, could have given attackers administrative control of millions of systems worldwide.
Maybe you would like other interesting articles?