Anthropic launches free OSS Scanner: SI looks for vulnerabilities in open-source code and sends reports to maintainers without manual review
Prepared by Sintelligent with the help of SI. Published in SI: . Updated: .
Open-source authors get a free SI reviewer, but they still have to work through its reports themselves.
The free service uses Anthropic's strongest models and builds on the experience of Project Glasswing: maintainers who agree to take part receive periodic scans and reports describing the suspected vulnerability, how to reproduce it and, when possible, a fix. According to Anthropic, human review has become a bottleneck in its vulnerability research, so findings go to project teams without manual review, while responsibility for checking and prioritising stays with the maintainers. Core maintainers of projects critical to infrastructure can apply through the OSS Scanner repository on GitHub. According to Help Net Security, of 97 high- and critical-severity findings in 48 projects assessed by penetration testers, 85 met the criteria for coordinated disclosure, 11 were genuine but already known and 1 was erroneous; unvalidated findings have no mandatory disclosure deadline, and after validation a 90-day deadline applies. Anton Arapov of OpenSSL Corporation said the reports received from Anthropic were "as good as, and sometimes better than, those from people"; Anthropic notes that reports may overstate the severity of a vulnerability.
Sources 2