Anthropic Gives Open Source Maintainers a Fast Track to Mythos Vulnerability Findings

Anthropic has launched OSS Scanner, a free, opt-in service designed to accelerate the remediation of open source vulnerabilities using its Claude models, including Mythos. The service allows participating maintainers to receive vulnerability reports—complete with reproduction steps and proposed fixes—without waiting for manual review by Anthropic's internal research teams, addressing a reported bottleneck where triage has lagged behind discovery volume. While this aims to expedite patching processes, the immediate availability of unreviewed findings is caveated; eligibility requires projects capable of handling high-severity audits. Initial testing indicated that 85 of 97 evaluated findings met disclosure criteria.
This initiative positions itself as part of a larger push toward automating security triage and code hardening. While successful early adoption examples show fixes being deployed rapidly, like those by Mozilla and wolfSSL, the system highlights an uneven capacity across the open-source ecosystem, noting that resource limitations determine which projects can immediately capitalize on these AI insights. Furthermore, maintainers retain control over context through optional threat model files, although they still must perform the ultimate verification and patching work.

Anthropic launched OSS Scanner, a free, opt-in service utilizing Claude models like Mythos to scan open source projects for vulnerabilities.
The service sends maintainers reports with reproduction steps and proposed fixes without waiting for Anthropic researcher validation.
Over six months, Anthropic found over 29,000 candidate vulnerabilities but manually reviewed approximately 6,000.
Anthropic has sent nearly 5,000 unvalidated reports in response to requests from some maintainers.
Initial testing involved penetration testers examining 97 high- and critical-severity findings across 48 projects.
Of the tested findings, 85 met Anthropic’s coordinated disclosure criteria.
Project PostgreSQL's Noah Misch reported that proposed patches were usable almost unchanged via early access.
Mozilla shipped fixes for 271 vulnerabilities identified during an early Mythos Preview evaluation.
Maintainers provide a project configuration and Dockerfile to enable offline audits.
If later validated by Anthropic, the 90-day disclosure clock begins upon maintainer notification.