Anthropic has announced a new tool, OSS Scanner, that allows open source projects to scan their code for security vulnerabilities for free. The scanning will be performed using the company's most powerful artificial intelligence models, including Claude Mythos.
Anthropic has announced a new tool, OSS Scanner, that allows open source projects to scan their code for security vulnerabilities for free. The scanning will be performed using the company's most powerful artificial intelligence models, including Claude Mythos.
The main feature of OSS Scanner is that projects that join the program will receive regular automated vulnerability reports. However, the reports will be generated exclusively by artificial intelligence - without prior verification or moderation by cybersecurity experts, Engadget reports .
“This scanner’s reports will be entirely model-generated, with no human verification or sorting. This will allow for faster and more frequent scans, although it does mean that some reports may be false or inaccurate. This leverages our most powerful models (including Claude Mythos) to give open-source projects the maximum protection advantage,” Anthropic explained.
The company noted that they were inspired to create the tool by the OSS-Fuzz scanner, developed by Google in conjunction with the OpenSSF (Open Source Security Foundation), which has been operating since 2016. In addition, Anthropic already has a paid corporate product, Claude Security, for deep code auditing and remediation, while OSS Scanner is aimed specifically at the open source community.
The launch of such free tools by IT giants has a clear practical basis. Most modern services from Anthropic, Google and other companies are based on open source, which is often maintained by independent developers on a volunteer basis. Critical vulnerabilities in popular libraries can put millions of systems around the world at risk. A vivid example of this was the incident with a backdoor in XZ Utils, which almost gave hackers administrative access to infrastructure around the world.
Thanks to OSS Scanner, open source software developers will be able to quickly identify potential threats before they are exploited by attackers.
