Anthropic offers free security scans to open source, but with no human reviewing the alerts

By Zendoric · October 9, 2026.

Anthropic has launched OSS Scanner, a free, opt-in service that analyzes the code of open-source projects in search of vulnerabilities. According to the company's own announcement, projects that sign up will receive "comprehensive, regular security scans from our most powerful models, at no cost", among them Claude Mythos.

The important nuance is in the fine print. Anthropic admits that the reports "will be generated entirely by the model, with no human review or triage", which allows for faster and more frequent scanning, but also opens the door to some alerts being "incorrect or invalid". It is the company itself that acknowledges the price of speed: less filtering, more potential noise.

That risk is not hypothetical. AI tools have already uncovered serious flaws in open-source software, such as the bug known as "Copy Fail", which in May affected practically every Linux distribution, as reported by The Verge. But the same outlet recalls that the phenomenon has a flip side: maintainers such as Linus Torvalds, and even a giant with Google's resources, are dealing with a sudden avalanche of AI-generated bug reports that they cannot process at the rate they arrive.

Another piece of coverage of the launch, from CyberScoop, places OSS Scanner within a broader program through which Anthropic says it is making a "long-term" commitment to the security of critical infrastructure and open-source software. Read that way, it is not just a standalone tool: it is one more piece in how the big AI labs want to position themselves as guarantors of the cybersecurity of the software that holds up the internet, a terrain where Anthropic has been pushing hard.

Our reading: giving the open-source community free scanning by its most powerful models is, at the same time, defensive philanthropy and a cheap way to test Mythos against real code at massive scale, on one of the largest attack surfaces on the planet. The winner is the company that best trains its model on that data; it is less clear that the volunteer maintainers who were already swamped with automated alerts before this one arrived come out ahead. Anthropic's own acknowledgment that there will be no human oversight is honest, but it shifts the cost of filtering false positives onto those who have the least time to do it.

In the medium term, the experiment is worth following: if Anthropic gets the model's precision right, this fits the underlying thesis that AI can multiply the defensive capacity available to projects that could never afford a professional security audit, freeing those teams to spend their scarce time on what genuinely requires human judgment. In the short term, however, open source runs the risk of going from a shortage of expert eyes to a glut of automated alerts with nobody to tell signal from noise.