Anthropic will send open-source maintainers AI bug reports before a human checks them

Anthropic on Thursday launched what it calls the Anthropic Cyber Mission, a long-term security effort that starts with two concrete pieces: a program that puts frontier Claude models and on-site engineers inside the security firms that defend power grids, water systems and transport networks, and OSS Scanner, a free, opt-in service that sends open-source maintainers model-generated vulnerability reports without waiting for a human to review them first.

The second piece is the one most developers will actually touch, and it is also the more unusual decision. Until now, Anthropic's open-source bug reports went through a human-reviewed coordinated disclosure process. OSS Scanner lets eligible projects skip that queue.

Why skip human review

The reason is a backlog. In its research post, Anthropic says its models surfaced more than 29,000 candidate vulnerabilities in open-source software over the past six months, while its team manually reviewed and triaged roughly 6,000. Human review keeps false positives away from maintainers, but it is slow, and the gap between what models find and what people can verify keeps growing.

OSS Scanner is Anthropic's answer: projects that can already handle a stream of high and critical reports opt in, and receive findings as soon as the strongest models produce them. Each report includes a reproducer, an explanation and, where available, a proposed patch. The pipeline includes agents that double-check bugs and do root-cause analysis, but no person signs off before the email goes out.

How accurate is it?

Anthropic's announcement says it expects a true-positive rate above 90%. The evidence behind that figure is narrower than the headline. Expert penetration testers reviewed 97 critical and high-severity findings from an early version of the scanner across 48 projects; 85 of them (88%) met the bar for Anthropic's disclosure process. Of the remaining 12, Anthropic says 11 were real bugs that duplicated known issues or other scanner findings, and one was a false positive.

That is a small sample from an early build, measured by Anthropic's own reviewers. The company also quotes maintainers from wolfSSL, PostgreSQL, OpenSSL and HotCRP; wolfSSL's Todd Ouska, for example, says all but two of 74 reports were valid and five became CVEs. Those are favorable testimonials selected by the vendor, not an independent evaluation. Anthropic itself warns that reports may contain errors, such as inflated severity ratings or a misread threat model.

How enrollment works

According to the OSS Scanner page and the GitHub repository, a core maintainer opens a pull request that adds a project directory with a project.yaml (repository and security contact) and a Dockerfile that builds the project. Eligibility mirrors Google's OSS-Fuzz: established projects with critical impact on infrastructure and user security, judged case by case, with Anthropic verifying that the requester is a core maintainer.

• The project is built in an isolated VM with network access, then scanned with Internet access fully disabled. Anything the build or tests need must be fetched during the Dockerfile step.
• Maintainers can add an optional threat_model.md. Anthropic says it is most useful for telling the scanner how the project rates severity, where untrusted input enters, and what is out of scope.
• Unvalidated findings carry no 90-day disclosure deadline and Anthropic says it will not publish them. A finding later validated through its human-reviewed process may be disclosed 90 days after the maintainer is notified.
• Projects can pause reports with disabled: true or withdraw entirely by deleting their directory.

The threat-model file is the practical detail worth noting. It is effectively a standing prompt for the scanner, and Anthropic's own guidance suggests the main failure mode maintainers reported, wrong severity, is something a clear threat model can reduce.

The infrastructure side

The Critical Infrastructure Defense Program targets operational technology, the control systems behind utilities and transport, plus government systems. Rather than working with operators directly, Anthropic routes support through security providers: it will supply frontier models, on-site engineers and threat research to 11 founding security providers: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. It starts with a small cohort and Anthropic says it will expand to more partners and sectors over the coming months.

Anthropic is candid about the limits. Much operational technology cannot be patched while it runs, and the company says some fixes may take decades.

The bet behind both

Anthropic frames the mission around a forecast: in its view, AI will favor defenders in about two years, but for now the cost of exploiting vulnerabilities has fallen faster than the cost of fixing them. OSS Scanner is a wager that faster, noisier reports beat slower, cleaner ones for maintainers equipped to triage them. Whether that holds will depend on how the false-positive and severity numbers look once the scanner runs across many more projects, and on whether anyone outside Anthropic measures them.