Cybersecurity news — October 2026
On October 8, 2026, Anthropic launched OSS Scanner: a free, opt-in AI vulnerability scanner for open-source projects, powered by its strongest models including Claude Mythos. It grew out of Project Glasswing, which surfaced 29,000+ candidate vulnerabilities in six months — a volume humans could never triage. Would AI find the vulnerability in your open-source project?
OSS Scanner is an opt-in service: enrolled open-source projects receive thorough, periodic security scans by Anthropic's strongest models at no cost. Each report includes an explanation of the vulnerability, a self-contained reproducer, a bisection of when the bug entered the code (when possible), and a candidate patch. It is informed by Project Glasswing, Anthropic's research program that surfaced over 29,000 candidate vulnerabilities in six months — of which only about 6,000 could be manually triaged. That triage bottleneck is exactly what OSS Scanner removes: reports are fully model-generated, with no human review or triage before they reach maintainers.
To validate the scanner, Anthropic's penetration testers reviewed 97 critical and high-severity findings across 48 projects:
Early participants back it up. wolfSSL's Todd Ouska said the project received 74 reports, all but two valid, with five becoming CVEs. curl creator Daniel Stenberg said the scanner surfaced one of the worst curl vulnerabilities in years. A PostgreSQL maintainer said an unusually high fraction of findings uncovered real defects.
Core maintainers enroll by opening a pull request on Anthropic's OSS Scanner GitHub repository with a YAML config (repo link, primary contact email) and a Dockerfile that builds the project offline so an agent can audit it without internet access. Eligibility mirrors Google's OSS-Fuzz: projects must have critical infrastructure or user-security impact — selective, not universal. 116 projects applied in launch week.
Context worth noting: OSS Scanner is one piece of Anthropic's broader "Cyber Mission," alongside a Critical Infrastructure Defense Program for operational technology in utilities. The same company that warned about self-replicating AI worms spreading through smart TVs is now deploying AI to find vulnerabilities — two sides of one strategy: AI changes both the attack surface and the defense.
Five questions on the facts above. Click an answer per question.
1. Anthropic's pen-testers reviewed 97 critical/high findings across 48 projects. How many met the coordinated-disclosure bar?
2. Who reviews OSS Scanner reports before they reach maintainers?
3. How does an open-source project enroll in OSS Scanner?
4. How many candidate vulnerabilities did Project Glasswing surface in six months?
5. wolfSSL received 74 scanner reports. How many became CVEs?
OSS Scanner, launched October 8, 2026, is a free, opt-in vulnerability scanner for open-source projects, powered by Anthropic's strongest models including Claude Mythos. Enrolled projects receive periodic, model-generated security reports at no cost.
No. Reports are fully model-generated with no human review or triage before reaching maintainers. Anthropic's own caveat: this allows faster, more frequent scanning, but some findings may be incorrect or invalid — maintainers must validate every report.
In validation, Anthropic's penetration testers reviewed 97 critical and high-severity findings across 48 projects: 85 (88%) met the coordinated-disclosure bar, 11 were real but duplicates, and 1 was a false positive. wolfSSL received 74 reports, 72 valid, 5 became CVEs.
Core maintainers submit a pull request to Anthropic's oss-scanner GitHub repository containing a YAML configuration (repo link, primary contact email) and a Dockerfile that builds the project offline. 116 projects applied in launch week.
No. Eligibility mirrors Google's OSS-Fuzz criteria: projects must have critical impact on infrastructure or user security. Anthropic notes the process is decided case by case and may evolve over time.
Sources: Anthropic (October 8, 2026 announcement), The Hacker News (October 9, 2026), Engadget, Times of India. Findings summarized from reporting; validate any report against the original sources. This page is informational, not security advice.
Try BreachHunter — AI-powered vulnerability intelligence, early access