OSS Scanner by Anthropic (red.anthropic.com)

Anthropic has launched the OSS Scanner, an opt-in service designed to scan open-source repositories for security vulnerabilities. Drawing from their experience with their AI model Claude during Project Glasswing, this initiative allows participating projects to receive detailed vulnerability reports generated by advanced models at no cost. While Anthropic regularly conducts thorough human-reviewed scans of open-source software, the OSS Scanner offers a faster alternative by delivering preliminary reports directly after scanning, helping maintainers identify and address security issues promptly. This development is significant for the AI/ML community as it enhances the security posture of critical open-source projects, which play a foundational role in software infrastructure. OSS Scanner is tailored for established projects with considerable user impact, enabling maintainers to optimize their vulnerability management processes without being overwhelmed by false positives. Key technical components include a Dockerfile configuration for an isolated security audit environment and a flexible threat model input that allows maintainers to specify their security priorities. By covering scanning costs and simplifying the vulnerability reporting process, Anthropic aims to strengthen collaboration with the open-source community in the fight against cybersecurity threats.