Skip to content
estudIA
ES

NewsAnthropic2 min read

Anthropic Will Scan Open-Source Projects With Claude for Free

Anthropic’s Cyber Mission includes OSS Scanner, which checks open-source projects for vulnerabilities at no cost, plus a programme for critical infrastructure.

Key points

  • On 8 October Anthropic introduced the Cyber Mission, a long-term commitment to help the people who defend computer systems.
  • OSS Scanner periodically scans enrolled open-source projects for free with Claude’s most capable models.
  • Reports are written by the model without human review; Anthropic expects over 90% of findings to be real.
  • Another programme gives Claude to security firms that protect power grids, water and transport.

⚠ Pending verification. We have not yet confirmed these details with an official source. Check them before relying on them:

  • How much money Anthropic is putting into the Cyber Mission: the announcement gives no total.

AI models are now good at finding security flaws in code, and that helps attackers as much as defenders. On 8 October Anthropic introduced the Cyber Mission, which aims to tilt that advantage towards defence. It starts on two fronts: open-source software, which almost all of the internet depends on, and critical infrastructure.

OSS Scanner: free reviews for open projects

This is the part that matters most to developers. Inspired by OSS-Fuzz, Google’s service that hunts for bugs in open projects, OSS Scanner works like this:

  1. Maintainers of critical open-source projects opt in.
  2. Claude’s most capable models scan the code periodically, at no cost.
  3. Each finding comes with a proof of concept, an explanation and, where available, a suggested fix.

One key detail: the reports are written by the model and sent without human review. Anthropic warns that some may contain mistakes, such as the wrong severity rating, and expects a true-positive rate above 90%. Projects that cannot handle that volume will keep receiving human-verified reports, as before.

Maintainers can also apply for free Claude Max subscriptions through Claude for Open Source.

Critical infrastructure

The Critical Infrastructure Defense Program gives security firms that protect power, water, transport and government systems access to Claude’s frontier models, Anthropic engineers and its threat research. It starts with a small group, including Accenture, CrowdStrike, Deloitte, Palo Alto Networks, PwC and Rockwell Automation, and Anthropic plans to widen it over the coming months.

Why it matters

The same models that find flaws to fix them could be used to exploit them. Anthropic forecasts that “in two years, AI will favor defense”, but admits the near term may not follow that trend. Thoroughly reviewing open source, often maintained by a few people with few resources, is one of the most direct ways to tip the balance.

What it means for you

  • If you maintain an open-source project, you can enrol in OSS Scanner and apply for free Claude Max. Check each finding before shipping a fix: no person has reviewed it.
  • If you only use software, there is nothing to do: if the programme works, your dependencies will have fewer holes.
  • If you are curious how models are stress-tested, see red teaming.

Glossary terms

Sources

Related articles