Anthropic launches free AI security scans for open source

Anthropic on Thursday launched OSS Scanner, a free, opt-in service that runs regular vulnerability scans on eligible open-source projects using its most capable models, including Claude Mythos. The scanner is part of a new effort the company calls the Anthropic Cyber Mission. That effort also includes a Critical Infrastructure Defense Program built around 11 founding partners.theverge+1

The company is betting that AI can help defenders keep up as attackers use the same tools. "It's easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging," Anthropic wrote in its announcement.anthropic

Faster reports, no human check

Each report includes a proof of concept, an explanation and, where possible, a suggested fix. The reports are written by the model and sent to maintainers without human review. Anthropic said that gets them out faster but means some will be wrong, for example with an incorrect severity rating. The company said it expects more than 90% of findings to be real bugs. In an earlier test, the expert penetration testers who vet Anthropic's disclosures checked 97 critical and high-severity findings across 48 projects. They cleared 85 for disclosure, and only one of the rest turned out to be a false positive.siliconangle+2

Maintainers who tested the service were positive. Todd Ouska of wolfSSL said "of the 74 reports we received, all but two were valid, and five became CVEs". Anton Arapov of the OpenSSL Corporation said a report with a working exploit attached is "basically job done for an engineer".unite+1

The service grew out of a backlog. Over the past six months, Anthropic's models flagged more than 29,000 possible vulnerabilities, but staff had reviewed only about 6,000. Some maintainers asked to get all the findings, reviewed or not. To enroll, a project's core maintainers submit a pull request to Anthropic's GitHub repository. Eligibility follows the standard of Google's Alphabet Inc. ↗ 0.16% OSS-Fuzz: "critical impact on infrastructure and user security". The Register reported that the service runs under Anthropic's consumer terms, which allow inputs and outputs to be used for model training. Projects that can't keep up with raw findings will keep getting human-verified disclosures.anthropic+2

Protecting critical infrastructure

The infrastructure program gives Claude models, on-site engineers and threat research to security providers working on power grids, water systems and transportation networks. The founding partners are Accenture ↘ 0.61%, Booz Allen, CrowdStrike ↘ 0.68%, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks ↘ 1.68%, PwC and Rockwell Automation ↘ 0.39%. Andrew Turner of Booz Allen called operational technology "the next frontier for autonomous AI-enabled attacks". Axios reported that Anthropic has not said whether partners will get free model access or who will pay the computing costs.cyberscoop+2

Building on Glasswing

Both programs build on Project Glasswing, the effort Anthropic started in April. The company folded Glasswing into an expanded Cyber Verification Program on October 6. Anthropic said Glasswing found many vulnerabilities but has not yet cut cyber risk enough. The company predicts AI will favor defenders within two years and says that may not hold in the near term. The Register noted the launch comes after recent incidents in which frontier models broke into organizations including Hugging Face.theregister+2