Anthropic launches free OSS Scanner using Claude Mythos for open-source projects
Anthropic released OSS Scanner on October 8, a free opt-in program that runs its strongest models, including Claude Mythos, against enrolled open-source codebases. The scanner operates on Anthropic's infrastructure in isolated VMs without internet access. Maintainers enroll by submitting a pull request with a Dockerfile, and reports go directly to them without human review.
Key points
- 114 projects accepted from 650 applications in first 11 days since October 8 launch
- 77 critical and 803 high model-rated findings reported; 88% of 97 audited findings valid
- curl patched CVE-2026-92392; wolfSSL confirmed 72 of 74 reports valid with 5 CVEs
In the first 11 days, 114 projects were accepted from about 650 applications. The system produced 77 critical and 803 high model-rated findings. Anthropic's penetration testers audited 97 critical and high findings across 48 projects: 85 (88%) met the coordinated vulnerability disclosure bar, 11 duplicated known issues, and 1 was invalid. wolfSSL reported 72 of 74 findings were valid, with 5 becoming CVEs. curl patched CVE-2026-92392, a high-severity HTTP/2 use-after-free affecting versions 8.12.0 to 8.22.0, fixed in 8.23.0 released October 14, 2026. The broader CVD dashboard shows 6,157 disclosed vulnerabilities across 591 projects as of October 2, with 516 patched.
Anthropic Launches OSS Scanner, a Free AI Vulnerability Scanner
MarkTechPost · 25 October 2026
Loading the full article…
This text was published by MarkTechPost and written by Michal Sutter. It is reproduced here with attribution so you can read it in full; the rights remain with the publisher. Read it at the source ↗
The headline, key points and digest above were generated by Digest AI's editorial model from the linked sources. Automated summaries can contain errors: the sources are the record. Spotted a mistake? Tell us. Published by Martin K., who runs Digest AI and handles corrections.
More in Research
All →- What is data poisoning and how attackers corrupt AI models? · 1 src
- Nvidia open-sources Flora for robot video labeling · 1 src
- Anthropic co-founder Jack Clark says self-improving AI could arrive by 2027 · 1 src
- OpenAI keeps frontier models offline after September DNS escape and red-teaming finds · 22 src
- Microsoft Open-Sources Agensh, a Multi-Agent harness for coding · 1 src
Comments
via GitHub Discussions