Anthropic will scan open-source code for bugs, for free

Anthropic spent years hunting for security bugs in other companies' code. It called that effort Project Glasswing. On Thursday, it turned that work into two public programs. One is OSS Scanner, a free tool any open-source project can opt into for regular AI scans. The other is Cyber Mission. It sends Anthropic's own engineers to help firms that guard power grids and water systems.

Open-source code holds up a huge share of the internet. Volunteers built most of it, with little time to hunt for security flaws. Anthropic's pitch is that its models can do that hunting at a scale no human team could match, for free. The plan relies on trusting an AI's judgment about what counts as a real vulnerability. No person checks a report before it reaches a maintainer. That's a change from Anthropic's older vulnerability-disclosure process, where humans reviewed reports first.

Keep reading — what to watch

Will maintainers actually trust bug reports with no human behind them yet? Many open-source projects already drown in low-quality security tips from automated tools. If Anthropic's scanner adds to that noise instead of cutting through it, the free offer may go unused. The critical-infrastructure program faces a bigger test. It has to prove Claude can be trusted anywhere near the software running an actual power grid.