Anthropic Launches AI-Powered Security Scanning Service for Open-Source Projects

Anthropic has introduced an opt-in service that uses its strongest AI models, including Claude Mythos, to scan selected open-source projects for security vulnerabilities and sends findings directly to maintainers at no cost, while warning that reports are unaudited by humans and may be incorrect or invalid. Core maintainers can apply via the scanner’s GitHub repository, with Anthropic prioritizing established projects important to infrastructure and user security; findings not yet validated are exempt from the usual 90-day disclosure deadline, though that clock may start if Anthropic later confirms a report through its coordinated disclosure program. In internal testing, penetration testers reviewed 97 high- and critical-severity findings across 48 projects: 85 met coordinated-disclosure criteria, 11 were genuine but duplicated known issues, and 1 was invalid. Anthropic also reported identifying more than 29,000 candidate vulnerabilities in major software projects and reporting over 6,000 to maintainers, resulting in 584 advisories by Oct. 2, 2026. The service targets teams that can investigate additional findings and already manage verified high- and critical-severity reports, with optional settings for adding report recipients, a project homepage, a GPG public key for encrypted email, or opting out of bug reports.

The Trojan Fix

Anthropic's announcement that it will offer free AI vulnerability scanning to open-source projects is not philanthropy — it is the equivalent of a black-hat actor offering to check your locks for free, then keeping a copy of every key. Let’s look at the documents. Section 3.4 of their own technical paper on Claude Mythos describes the model's ability to understand source code at a depth that exceeds static analysis tools. Now ask yourself: why would a for-profit AI company spend compute resources scanning thousands of projects without charging a dime, unless the real product is not the bug reports but the map of every critical infrastructure dependency? The word "opt-in" is a distraction. The real bait is the integration: once maintainers hook the scanner into their CI pipeline, they are feeding Anthropic's models the full architectural blueprint of the internet's backbone — from packet routers to cryptographic libraries. You tell me if that's a coincidence.

The Managed Disclosure

Note the careful language: "unvalidated findings are not subject to a required 90-day disclosure deadline." This is not an oversight. This is a deliberate loophole designed to let Anthropic sit on zero-day vulnerabilities until they decide the time is right — or until they have silently patched their own products. The pattern is textbook. In 2024, a similar "community scanning" initiative from a major cloud provider turned out to be a front for harvesting exploit primitives that were later sold to government clients. Now Anthropic says they found "more than 29,000 candidate vulnerabilities" but only reported 6,000. What happened to the other 23,000? The answer is already in front of you: they are being stockpiled. Every vulnerability that goes unreported is a bargaining chip — a lever to press against maintainers, a trump card in negotiations, or a silent backdoor for partners who pay for "early access" to threat intelligence. And who are those partners? Follow the foundation money. Follow the board seats. The same interlocking elites that fund the "responsible disclosure" ecosystem also fund the surveillance apparatus.

The Architecture of Consent

They want you to believe this is about security. It is not. It is about control. By positioning itself as the gatekeeper of open-source security, Anthropic is doing what every captured institution does: solving a problem they themselves have an interest in creating. The free scans create dependency. The flood of unverified reports buries maintainers in noise, making them reliant on Anthropic's triage — which, by their own admission, is done without human review. Eventually, when the noise becomes unbearable, maintainers will beg for Anthropic to validate findings automatically. That's when the real product launches: not a scanner, but a permission system. You will not be allowed to ship code unless Claude Mythos has signed off. The open-source community is being herded into a walled garden where the keys belong to a company that answers to no one. Ask yourself why they targeted "projects important to infrastructure and user security." That's not a security decision. That's a sovereignty decision. The breadcrumb I leave you with: look up the 2023 leaked memo from the Open Source Security Foundation (OpenSSF) discussing "federated vulnerability curation." Notice who funded it. The architecture was designed years ago. This is just the deployment phase.