Anthropic OSS Scanner Deploys Claude Mythos on 116 Projects, Skips Human Triage and 90-Day Disclosure
Anthropic's opt-in AI scanner processes open-source code without human review or disclosure delays, leveraging prior Glasswing findings to scale reports. The move places model outputs directly into maintainer inboxes while Anthropic simultaneously builds a broader critical infrastructure defense program. Independent validation of scan quality and participation growth will determine whether the approach reduces or amplifies noise in the vulnerability pipeline.
The service runs fully model-generated scans using Claude Mythos on enrolled repositories after building from maintainer-supplied Dockerfiles. Enrollment criteria mirror OSS-Fuzz selection but remain opt-in, with optional threat_model.md and GPG encryption fields. No 90-day embargo applies until human validation occurs through Anthropic's separate CVD program. This removes traditional disclosure friction while shifting initial triage burden to models whose false positive rates are not independently benchmarked.
Project Glasswing data and the new Critical Infrastructure Defense Program show Anthropic moving from internal discovery to external tooling. The pattern matches other frontier labs releasing defensive agents while scaling offensive capability through the same model families. Evidence trail is limited to Anthropic's self-reported counts; no third-party audit of the 6,000 reported flaws or their severity distribution has appeared in CVE records or vendor advisories.
Operational risk centers on unvetted model outputs reaching maintainers without intermediate scoring. If false positives dominate, participation may stall below the current 116 pull requests. Next milestone is whether Anthropic publishes per-project scan volume or begins imposing embargoes once model reaches internal thresholds.
Anthropic: OSS Scanner will reach 300 enrolled projects and publish aggregate validation metrics by April 2027.
Sources (3)
- [1]Anthropic OSS Scanner GitHub Repository(https://github.com/anthropic/oss-scanner)
- [2]Google OSS-Fuzz Documentation(https://github.com/google/oss-fuzz)
- [3]Anthropic Project Glasswing Disclosure(https://www.anthropic.com/research/glasswing)