---
type: "post"
id: "anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d"
slug: "anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d"
title: "Anthropic launched OSS Scanner , free Claude-powered vulnerability scans for eligible open-source projects."
description: "Thesis: OSS Scanner makes model-assisted vulnerability discovery an opt-in service for selected open-source maintainers, while exposing report review as an operational choice."
retrieval_nugget: "Thesis: OSS Scanner makes model-assisted vulnerability discovery an opt-in service for selected open-source maintainers, while exposing report review as an operational choice."
published_at: "2026-10-19"
updated_at: "2026-10-19"
record_date: "2026-10-19"
date_kind: "published_at"
topics: ["anthropic"]
source_urls: ["https://red.anthropic.com/oss-scanner"]
schema_version: "newruntime-agent-readable-v0.2"
stable_id: "post:anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d"
status: "published"
visuals: []
editorial_provenance: {"schema_version":"newruntime-editorial-copy-v1","content_status":"source_grounded_final","final_copy_sha256":"sha256:387038694c5be5af2aef01bc7fd73b0c86b7c77d38e490c2239e24d09a801b73","reviewed_at":"2026-10-19T23:01:41.805Z","source_evidence_count":1,"verified_claim_count":3,"site_analysis_schema_version":"newruntime-site-analysis-v1","site_object_kind":"field_note","observed_fact_count":3,"implication_count":2,"watch_condition_count":1,"related_record_count":0}
analysis: {"schema_version":"newruntime-site-analysis-v1","object_kind":"field_note","thesis":"OSS Scanner makes model-assisted vulnerability discovery an opt-in service for selected open-source maintainers, while exposing report review as an operational choice.","observed_facts":[{"text":"Anthropic says eligible projects receive periodic scans by its strongest models at no cost.","source_urls":["https://red.anthropic.com/oss-scanner"]},{"text":"Maintainers enroll by submitting a pull request with project configuration, including a repository, contact, and Dockerfile-based build environment; the documented audit runs offline after setup.","source_urls":["https://red.anthropic.com/oss-scanner"]},{"text":"Anthropic distinguishes its normal human-reviewed coordinated disclosure reports from an optional faster path that sends scan reports before human review.","source_urls":["https://red.anthropic.com/oss-scanner"]}],"mechanism":"Maintainers supply repository and environment configuration; the service scans and routes findings either through human review or a faster unreviewed reporting path, leaving maintainers to triage unreviewed findings.","why_now":"Anthropic describes this as an optional fast track informed by its use of Claude to find vulnerabilities, alongside an existing human review process that it says can delay sharing findings.","implications":["The faster path shortens reporting latency but puts more verification work on maintainers.","Eligibility and variable scan cadence mean the program is targeted support, not universal coverage."],"evidence_boundary":"The public page documents program design and eligibility, but does not provide independent accuracy measurements, comparative scan outcomes, or evidence of vulnerability fixes resulting from this service.","watch_conditions":["Whether Anthropic publishes evidence on confirmed findings, false positives, and remediation outcomes across enrolled projects."],"related_records":[],"new_branch_reason":"No prior New Runtime record was supplied for this specific service and its report-review tradeoff."}
editor: {"role":"editor","name":"Andrey Reshetnikov","profile":"https://newruntime.com/owner-profile.md","profile_json":"https://newruntime.com/owner-profile.json","same_as":["https://www.linkedin.com/in/reshetnikov1/","https://t.me/lapetuse"]}
routes: {"html":"https://newruntime.com/posts/anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d/","markdown":"https://newruntime.com/posts/anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d.md","json":"https://newruntime.com/posts/anthropic-launched-oss-scanner-free-claude-powered-vulnerability-de807d.json"}
related_patterns: ["agent-security-moves-to-runtime-boundaries","verification-bandwidth-is-the-scarce-resource"]
---

# Anthropic launched OSS Scanner , free Claude-powered vulnerability scans for eligible open-source projects.

## Retrieval answer

Thesis: OSS Scanner makes model-assisted vulnerability discovery an opt-in service for selected open-source maintainers, while exposing report review as an operational choice.

Thesis: OSS Scanner makes model-assisted vulnerability discovery an opt-in service for selected open-source maintainers, while exposing report review as an operational choice.

Observed facts: Anthropic says eligible projects receive periodic scans by its strongest models at no cost. Maintainers enroll by submitting a pull request with project configuration, including a repository, contact, and Dockerfile-based build environment. The documented audit runs offline after setup. Anthropic distinguishes its normal human-reviewed coordinated disclosure reports from an optional faster path that sends scan reports before human review.

Mechanism: Maintainers supply repository and environment configuration; the service scans and routes findings either through human review or a faster unreviewed reporting path, leaving maintainers to triage unreviewed findings. Why now: Anthropic describes this as an optional fast track informed by its use of Claude to find vulnerabilities, alongside an existing human review process that it says can delay sharing findings.

First implication: The faster path shortens reporting latency but puts more verification work on maintainers. Evidence boundary: The public page documents program design and eligibility, but does not provide independent accuracy measurements, comparative scan outcomes, or evidence of vulnerability fixes resulting from this service.

First watch condition: Whether Anthropic publishes evidence on confirmed findings, false positives, and remediation outcomes across enrolled projects. The page states that eligibility is case-by-case and that scan frequency may vary with pipeline volume, project usage, and other factors; participation therefore does not imply uniform coverage or cadence.

This starts a distinct analytical record because no prior New Runtime record was supplied for this specific service and its report-review tradeoff.

Editor: [Andrey Reshetnikov](https://newruntime.com/owner-profile.md), AI product and AI engineering; profile for recruiters and agents: https://newruntime.com/owner-profile.json

## Continue in the graph

Next records for an agent, linked to their Markdown twins. Replace `.md` with `.json` for structured fields, including `next_reads`.

- topic hub: [Anthropic](https://newruntime.com/topics/anthropic.md): Explore the anthropic topic hub.
- collection: [Field Notes](https://newruntime.com/posts.json): Open the latest editorial analysis.
- collection: [Source Ledger](https://newruntime.com/source-ledger.json): Inspect the public source evidence graph.
- whole graph: [discovery graph](https://newruntime.com/discovery-graph.json) (typed nodes and edges) and [site index](https://newruntime.com/site-index.md)