Open-source projects can now use Mythos to find security flaws in their code and get proposed fixes.
Anthropic now offers a free service called OSS Scanner that uses its most powerful AI models, including Claude Mythos, to scan open-source software for security flaws. Projects that sign up will get regular scans and a report on each flaw the models find.
Most company software is built partly from open-source code. A 2026 Black Duck report found it in 98% of the commercial software the report examined. Teams that run widely used open-source projects can now get reports from Anthropic’s most powerful AI to help them find and fix flaws at no cost.
Anthropic’s AI is finding flaws faster than its staff can check them
Anthropic said AI models have become far better at finding security flaws. On CyberGym, a test researchers built from 1,507 real security flaws in 188 software projects, AI models found under 20% of the known flaws at the start of 2025. The same test found over 85% this year.
Over the past six months, Anthropic’s models flagged more than 29,000 possible flaws in widely used software. Anthropic’s staff checked about 6,000 of them. When Anthropic sent its first staff-checked reports to the people running the affected projects, many asked for every report it had, along with proposed fixes, including ones its staff hadn’t checked. Anthropic has sent nearly 5,000 of those unchecked reports so far. Anthropic said attackers can now turn a flaw into a working attack in minutes, so projects that fix flaws faster are better protected.
The scanner’s reports reach projects with no human check
OSS Scanner’s reports are written entirely by AI, and no one at Anthropic reviews them before they go out. Anthropic said this lets it scan projects faster and more often, but it also means some reports may be wrong.
Each report includes step-by-step instructions that reproduce the flaw, so the project team can confirm it is real. It also explains the flaw and includes a proposed fix, when the AI can write one. Anthropic said it will keep sending separate reports that its own staff checked, especially to understaffed projects that lack the people to sort through reports themselves.
Security experts confirmed most of the serious flaws they checked
Anthropic asked the security experts who review its human-reviewed reports to examine 97 flaws the scanner rated as serious across 48 projects. Of those, 85 (88%) met Anthropic’s standard for reporting a flaw to a project. Of the other 12, 11 were real flaws already reported, either before the scan or elsewhere in it, and one was not a flaw at all.
Some project teams told Anthropic that the scanner overstated a flaw’s severity or misjudged what their project is meant to protect against. Anthropic said it cannot guarantee the scanner will be perfect and will keep improving it.
Anthropic decides which projects can join
Project lead maintainers, the people who decide what changes go into its code, sign up by sending a request through GitHub, the website where many open-source projects store their code. Anthropic said projects should have “critical impact on infrastructure and user security,” and that it will decide on each one individually.
The service follows Anthropic’s Oct. 6 expansion of Project Glasswing, a program that lets approved organizations use its most powerful AI models to find and fix software security flaws. At the time, Anthropic said it would publish more on its work securing open-source software in the coming weeks.
