Anthropic Launches OSS Scanner for Free Periodic Vulnerability Scans of Open-Source Projects

Anthropic has launched OSS Scanner, a service that provides free periodic vulnerability scans for eligible open-source projects. The service is voluntary, and Anthropic bears the cost. Each finding is accompanied by concept validation, and when feasible, a patch is also provided.

The eligibility criteria for projects are similar to OSS-Fuzz, targeting mature projects that have a critical impact on infrastructure and user security. Anthropic considers factors such as remote attack risk, user and downstream project numbers, project age and update frequency, OpenSSF criticality score, open-source license, star count, and branch numbers, as well as the security importance of the project’s domain.

Project administrators can join by submitting a pull request to the anthropics/oss-scanner GitHub repository, adding a project configuration file. Required fields include repository location, primary contact, and Dockerfile, which must be able to build the project for offline proxy auditing.