1 link tagged with all of: open source + oss scanner + security + anthropic + ai
Click any tag below to further narrow down your results
Links
Anthropic is offering free, fully model-generated security scans to eligible open source projects through a new program called OSS Scanner, with reports delivered without human triage. Early testers say the findings were mostly valid, though the company admits some reports will be wrong.
- Anthropic's models found over 29,000 candidate vulnerabilities in six months, but only about 6,000 have been manually reviewed, so human review is the bottleneck.
- OSS Scanner reports go out unverified, but in a pilot, 85 of 97 critical and high-severity findings (88%) met the bar for Anthropic's disclosure process, and only one was a false positive.
- Eligible projects get reports with a reproducer, an explanation, and often a candidate patch; several maintainers said the reports were high quality, and some chained bugs into unauthenticated remote code execution.