Anthropic拥有发布 OSS扫描仪，是关键开源项目的免费选入脆弱性扫描仪。 Anthropic 开放源码软件扫描机运行公司最强的模型，包括Claude Mythos，对接已注册的代码库。 报告直接交给维护者而不经过人文审查。 这种贸易提供更快的调查结果，但将分门别类的工作转移到项目小组。 10月8日发布事件后11天，Anthropic报道了77起关键事件和803起高模型评分结果。
TL; DR 数据
- 规模：截至10月19日，从约650份申请中接受了114个项目。
- Anthropic基础设施免费运行。 维护者提供一个 Docker 文件；在一个孤立的VM中进行审计，没有互联网。
- 业绩：97项审计的批评和高结论中有85项(88%)符合Anthropic的披露标准。
- 最佳：97项审计结论中只有1项是虚假的阳性。 WolfSSL 称 74份报告中有72份有效。
- 最糟的是，分娩前没有人体检查在97项审计结论中，有11项重复了已知的问题；维护者报告说，严重程度过大。
Anthropic OSS扫描仪是什么？
OSS Scanner是Anthropic的一种免费应用，它以其最强的模型定期审核开源寄存器。 边疆红队与保障研究队共同管理。 该设计借用了Google的OSS-Fuzz，但将模糊器交换为语言模型。
主要目标是审查瓶颈。 超过6个月，Anthropic的模型浮出29,000个候选弱点。 人类评论家对其中大约6000人进行了分化。 还有近5 000份报告直接交给维护者，他们要求得到一切，是否得到证实。 开放源码软件扫描器将这个临时请求变成一个选入程序。
OSS扫描仪是如何工作的？
核心维护者通过在anthropics/oss-scanner上打开拉出请求来注册。 PR 新增项目/"项目"/project.yaml，以项目模板为基础。
- 需要的字段：repo, prime contact，和一个多克文件路径。
- 可选字段：威胁-模型、加密报告pgp、自动 cc、主页和禁用。
Dockerfile通过网络访问构建项目。 然后VM移动到一个没有互联网的网络进行审核。 管道中Agents双检查出错误，运行根原因分析并提议补丁。
每份报告都包含一个自成一体的复制器和对虫子的解释。 在可能情况下，它包括一个分节承诺推出它。 可用时附上一个候选补丁。
一个可选的威胁 model.md定义了对抗性输入，范围外的代码和重度分。 没有它，扫描仪猜测。
OSS扫描仪报告有多准确？
Anthropic团队要求其穿透测试人员检查48个项目的97个关键和高发现。
- 85个(88%)达到了Anthropic协调的脆弱性披露程序。
- 11个是真实的，但重复了已知的问题或其他扫描结果。
- 1号无效
维护者数据指向同一个方向。 WolfSSL收到74个报告；除2个外，所有报告都有效，5个成为CVES. 卷曲补丁 CVE-2026-92392，一款高分HTTP/2上传后无用。 它会影响卷曲8.120至8.22.0并固定于8.23.0，发布 October 14,2026.
Anthropic将时间与基准测试进度联系起来。 在CyberGym上，LLMs从发现不到20%的弱点到超过85%. 其更广泛的CVD仪表板列出了591个项目中6 157个已披露的脆弱性，截至10月2日，其中516个项目已补齐。
OSS 扫描器与其他开源安全程序
资料来源：OSS-Fuzz披露指南，OpenAI Codex Security, DeepMind CodeMender.
关键外卖
- OSS扫描仪提供关键的开源项目免费Claude神话审计。
- 报告不经过人力审查；97项经审计的批评/高结论中有88%是有效的。
- 前11天：77个批评和803个高模型评分结果。
- 注册是一种带有多克文件的公关；审计运行离线。
- 对未核实的调查结果不适用90天的期限。
请检查access-date=中的日期值 (帮助) 发布站，OSS扫描仪FAQ站和GitHub回放站。 并加入我们的通讯。 等等，你在电报里吗？现在你也可以加入我们的电报。
需要和我们合作推广您的 GitHub Repo OR Hugging Face Page OR Product Release OR Webinar等吗？联系我们
米哈尔·萨特(Michal Sutter)是一名数据科学专业人员，拥有帕多瓦大学的数据科学硕士。 在统计分析、机器学习和数据工程的坚实基础上，Michal出色地将复杂的数据集转化为可操作的见解。
本文由 AI宝库自动抓取并翻译，版权归原作者所有；如需查看原文请点下方链接。
Anthropic has launched OSS Scanner, a free, opt-in vulnerability scanner for critical open-source projects. The Anthropic OSS Scanner runs the company’s strongest models, including Claude Mythos, against enrolled codebases. Reports go straight to maintainers without human review. That trade delivers faster findings, but shifts triage work onto project teams. 11 days after the October 8 launch, Anthropic reported 77 critical and 803 high model-rated findings.
TL;DR
- Scale: 114 projects accepted from about 650 applications, as of October 19.
- Runs on: Anthropic’s infrastructure, free. Maintainers supply a Dockerfile; audits run in an isolated VM with no Internet.
- Performance: 85 of 97 audited critical and high findings (88%) met Anthropic’s disclosure bar.
- Best: Only 1 of 97 audited findings was a false positive. wolfSSL says 72 of 74 reports were valid.
- Worst: No human review before delivery. 11 of 97 audited findings duplicated known issues; maintainers report inflated severity.
What is Anthropic OSS Scanner?
OSS Scanner is a free application from Anthropic that periodically audits open-source repositories with its strongest models. The Frontier Red Team and Safeguards Research team run it together. The design borrows from Google’s OSS-Fuzz, but swaps fuzzers for language models.
The main goal is a review bottleneck. Over 6 months, Anthropic’s models surfaced over 29,000 candidate vulnerabilities. Human reviewers triaged roughly 6,000 of them. Nearly 5,000 more reports went directly to maintainers who asked for everything, validated or not. OSS Scanner turns that ad hoc request into an opt-in program.
How does OSS Scanner work?
Core maintainers enroll by opening a pull request on anthropics/oss-scanner. The PR adds projects/<project>/project.yaml, based on the project template.
- Required fields: repo, primary_contact, and a Dockerfile path.
- Optional fields: threat_model, pgp for encrypted reports, auto_ccs, homepage, and disabled.
The Dockerfile builds the project with network access. The VM then moves to a network without Internet for the audit. Agents in the pipeline double-check bugs, run root cause analysis and propose patches.
Each report contains a self-contained reproducer and an explanation of the bug. Where possible, it includes a bisection to the commit that introduced it. A candidate patch is attached when available.
An optional threat_model.md defines adversarial inputs, out-of-scope code and a severity rubric. Without it, the scanner guesses.
How accurate are OSS Scanner reports?
Anthropic team asked its penetration testers to check 97 critical and high findings across 48 projects.
- 85 (88%) met the bar for Anthropic’s coordinated vulnerability disclosure (CVD) process.
- 11 were real but duplicated known issues or other scan findings.
- 1 was invalid.
Maintainer data points in the same direction. wolfSSL received 74 reports; all but 2 were valid, and 5 became CVEs. curl patched CVE-2026-92392, a High-severity HTTP/2 upload use-after-free. It affects curl 8.12.0 to 8.22.0 and is fixed in 8.23.0, released October 14, 2026.
Anthropic links the timing to benchmark progress. On CyberGym, LLMs went from finding under 20% of vulnerabilities to over 85%. Its broader CVD dashboard lists 6,157 disclosed vulnerabilities across 591 projects, as of October 2. 516 of those are patched.
OSS Scanner vs other open-source security programs
Sources: OSS-Fuzz disclosure guidelines, OpenAI Codex Security, DeepMind CodeMender.
Key Takeaways
- OSS Scanner gives critical open-source projects free Claude Mythos audits.
- Reports skip human review; 88% of 97 audited critical/high findings were valid.
- First 11 days: 77 critical and 803 high model-rated findings.
- Enrollment is a PR with a Dockerfile; audits run offline.
- No 90-day deadline applies to unvalidated findings.
Check out the launch post, the OSS Scanner FAQ and the GitHub repo. Also, feel free to follow us on Twitter and don’t forget to join our 150k+ML SubReddit and Subscribe to our Newsletter. Wait! are you on telegram? now you can join us on telegram as well.
Need to partner with us for promoting your GitHub Repo OR Hugging Face Page OR Product Release OR Webinar etc.? Connect with us
Michal Sutter is a data science professional with a Master of Science in Data Science from the University of Padova. With a solid foundation in statistical analysis, machine learning, and data engineering, Michal excels at transforming complex datasets into actionable insights.
Auto-fetched and translated by AI Gem Box. All rights belong to the original author.