Anthropic’s Free Scanner: Please Bring Your Own Triage

Viddy the latest offer, droogies. On October 8, Anthropic launched OSS Scanner: free, opt-in, periodic security scans for eligible open-source projects. Core maintainers can apply through the linked GitHub repository; eligibility is assessed case by case. The enrollment details are worth reading before opening the floodgates.^[2]

The broader Anthropic Cyber Mission also includes a Critical Infrastructure Defense Program. It brings Claude models, on-site engineers and threat research to providers protecting operational technology behind power, water and transportation systems. Government systems are also in scope. That effort starts with a small cohort of providers. Anthropic’s launch announcement describes the rollout.^[1]

Now inspect the receipt.

• Discovery: Anthropic reports more than 29,000 candidate vulnerabilities over six months.
• Human attention: approximately 6,000 manually reviewed and triaged.
• New delivery arrangement: OSS Scanner reports are model-generated, without human review or triage. Severity ratings and findings can be wrong.^[2]

Those are Anthropic’s reported figures and caveats. Neither count gives us a total of confirmed, unique bugs. Subtracting them doesn’t produce a verified backlog of exploitable holes, either.^[2]

The evidence has encouraging bits. In a sample of 97 high- or critical-severity findings across 48 projects, 85 met Anthropic’s disclosure threshold. Eleven others were real but duplicated or related to other findings; one was invalid. Useful signal, with the obvious limit that this sample cannot certify the entire pile. The validation breakdown matters more than a triumphant bug-count headline.^[2]

My question is who pays for the attention after the scan finishes. A good reproducer can save a maintainer hours. A stream of reports still needs someone to reproduce, prioritize and repair the right things.

The offer could be useful. Before opting in, pick the person who owns that queue and give them time to work it. “Free” becomes less impressive when the invoice arrives as somebody’s weekend.

Horrorshow scanner. Humans sold separately.