Anthropic Sends Unreviewed AI Vulnerability Reports to Open Source Maintainers

The service builds on Project Glasswing findings that vulnerability discovery has accelerated while triage and patching lag by months. Maintainers who requested raw output now receive periodic scans of their projects using Claude models, including suggested fixes where available. This mirrors Google OSS-Fuzz automation but removes the verification step that previously delayed disclosures. Anthropic acknowledges potential inaccuracies in severity ratings yet positions the tool for projects with sufficient triage capacity.

The parallel Critical Infrastructure Defense Program recruits eleven partners including Dragos, Nozomi Networks, Rockwell Automation, and CrowdStrike to embed Claude models into OT security workflows. OT environments often retain known vulnerabilities for years because patches cannot be applied without halting operations. Anthropic supplies on-site engineers and threat research to these firms, starting with a limited cohort to test practical remediation strategies before scaling.

Contract and procurement patterns show AI vendors moving from capability demonstrations into defense-adjacent services. The dual initiatives reveal an internal tension: speed-focused disclosure for software projects versus cautious, partner-mediated deployment for critical infrastructure. Independent verification of claimed true-positive rates remains absent, and no public data yet quantifies whether unreviewed reports reduce mean time to patch or increase maintainer workload.

Expansion of both programs is scheduled for coming months, with additional sectors targeted after initial partner feedback. Success metrics will hinge on documented remediation counts rather than report volume alone.