Anthropic launched a free, opt-in AI security scanner for open-source projects this week, and it lands in a messy moment. AI can now find real bugs in code that humans have audited for years. It can also bury a volunteer maintainer in fake ones. Both things are true at once, and a small team has to decide what to do about it.
The new service, called OSS Scanner, runs periodic vulnerability scans on enrolled projects with Anthropic's strongest models. Each report comes with a reproducer, an explanation and, where possible, a candidate patch (Anthropic). It sits next to a crowd of similar efforts from Google, OpenAI, GitHub, Snyk and Semgrep, and next to a growing pile of low-quality AI reports that has made some maintainers shut their doors.
This piece sorts it out. What these tools do, which ones cost nothing, how to opt in without hurting yourself, and a workflow a two-person team can run. The short version: AI scanners are now good enough to take seriously, and nobody should merge what they produce without reading it.
What Anthropic's OSS Scanner does
Core maintainers enroll by opening a pull request on a GitHub repository, following a template. Anthropic decides case by case, using criteria similar to Google's OSS-Fuzz: a project needs "critical impact on infrastructure and user security" (Anthropic). So this isn't for every hobby repo. Think curl and wolfSSL, the kind of libraries half the internet links against.
It's free. A pot of money Anthropic calls the Defender Advantage Fund pays for the scans (SiliconANGLE), and the company says participation stays at no cost to enrolled projects.
The part that matters most is what's missing. Reports are "fully model-generated, without human review or triage," and Anthropic says plainly that some will be wrong (Anthropic). One example it gives is a bad severity rating. Projects without the staff to sort through reports can keep using Anthropic's existing disclosure process, where humans verify first (SiliconANGLE).
Anthropic's own numbers show why it thinks the trade is worth it. Expert penetration testers reviewed 97 critical and high-severity findings across 48 projects. Of those, 85 met the bar for coordinated disclosure, 11 were duplicates or real but already known, and one was invalid (Anthropic). Separately, wolfSSL reported that 72 of 74 reports from an early trial were valid, and they produced five CVEs (SiliconANGLE).
Daniel Stenberg, who runs curl, said the scanner found "one of the worst curl vulnerabilities reported in the last few years" (Anthropic). Keep in mind that every one of these figures comes from Anthropic or its partners. Anthropic also says it expects a true-positive rate above 90% (Anthropic), which is a forecast, not a guarantee for your repo.
What an AI scanner actually does: find, prove, patch
Old-style static analysis matches code against rules. It's fast and predictable and it floods you with warnings. The newer agentic scanners work more like a junior security researcher. They read the code, form a theory about where it breaks, try to trigger the break, and only then write it up.
That middle step is the one to look for. A finding that comes with a working exploit is a different animal from a finding that comes with a paragraph of confident prose.
Read the pipeline left to right. The first three steps are about being right: a candidate gets a real test before anyone sees it. Steps four and five are about being useful, with an explanation of what broke and a draft fix. The last box is yours, and it's amber for a reason. Google says every CodeMender patch gets human review, and GitHub's Autofix only suggests. Anthropic's scanner is the exception on triage, which is why that last box falls to you.
The field in 2026
OSS Scanner isn't alone. Google's DeepMind built Big Sleep, an agent that hunts for bugs, and CodeMender, which writes fixes. DeepMind said it had already upstreamed 72 security fixes to open-source projects, and that every patch was reviewed by human researchers first (Google DeepMind). CodeMender has since moved into a public preview for enterprise customers on Google Cloud, where it builds proof-of-concept exploits in a sandbox and returns tested fixes as diffs for developer review (Infosecurity Magazine).
OpenAI's version launched as Aardvark, a GPT-5-based agent that builds a threat model of your repo, watches new commits, confirms issues in a sandbox and proposes patches. OpenAI said it hit 92% on known and synthetic vulnerabilities in test repositories and had found issues that earned ten CVE IDs (OpenAI). OpenAI has since folded it into Codex under a new name: its Aardvark page now says "Aardvark is now Codex Security," available as a research preview (OpenAI). The docs describe Codex Security as an agent that helps teams "find, confirm, and fix vulnerabilities," with the cloud version still in research preview (OpenAI docs).
The map groups them by job, and the grouping is ours, not the vendors'. The top row hunts and proves. The middle row lives in your pipeline and works on every commit. The bottom row points the other way and tests AI systems themselves.
On the middle row, GitHub Copilot Autofix suggests fixes for alerts raised by CodeQL, GitHub's scanner. Semgrep and Snyk Code do similar work with their own engines, and SonarQube covers code quality plus security checks. CodeRabbit reviews pull requests. On the bottom row, garak probes language models for weaknesses, and PentestGPT drives penetration tests with a model. Our AI cybersecurity board ranks the wider set, and the code review board covers the pull request tools.
| Tool | Main job | Who can use it |
|---|---|---|
| OSS Scanner (Anthropic) | Finds and proves bugs, drafts patches | Enrolled open-source projects, free |
| Codex Security (OpenAI) | Finds, confirms and fixes | Research preview inside Codex |
| CodeMender (Google) | Scans, proves and patches | Public preview, Google Cloud customers |
| Copilot Autofix (GitHub) | Suggests fixes for CodeQL alerts | Free on public repos |
| Semgrep | Rule-based scanning with AI features | Free up to 10 contributors |
| Snyk Code | Code and dependency scanning | Free plan, 100 Code tests a month |
Most of what's in that table comes from vendor pages, and vendors describe their own products kindly. Treat the access terms as the useful column. They change fast.
The flip side: maintainers are drowning
The same models that find real bugs also write convincing fake ones. curl is the clearest case. Its bug bounty ran from 2019 until early 2026, paid out over $100,000 for 87 confirmed vulnerabilities, and then closed. By 2025 fewer than 5% of reports were confirmed, down from 15% or more in earlier years (Daniel Stenberg).
In the last week before the bounty ended, curl received seven submissions and none described a vulnerability (The Register). Stenberg's reasoning was blunt. The goal was to "remove the incentive for people to submit crap and non-well researched reports to us. AI generated or not." Apache Log4j's Piotr Karwasz described the same pattern, saying many reports "overlook the fundamentals of our security model, adding noise rather than value" (Daniel Stenberg).
Curl later went further. Stenberg wrote that the project paused vulnerability reports for a month this summer and called it "possibly our best project decision in a long while" (Daniel Stenberg).
Notice the same project that shut its bounty to stop AI noise also praised an AI scanner that found one of its worst bugs. That isn't a contradiction. The difference is a working reproducer and a sender who has already done the checking. A model that proves its claim costs the maintainer minutes. A person who pastes model output costs them hours.
Anthropic's scanner skips the human middleman, which is both the appeal and the risk. It speeds up delivery, and it also means a report can show up at your door without anyone having read it first. If you maintain a project, expect more of that from every vendor in the table.
Attackers have the same models
Anthropic's own announcement says "frontier models can be misused to exploit vulnerabilities and conduct cyber operations" (Anthropic). The practical reading is simple. Anyone can point a strong model at public code and ask where it breaks, and open source is public by definition.
That's the real case for scanning your own code. It isn't that AI scanners are magic. It's that the window between a bug existing and someone else finding it is getting shorter, and you'd rather be first. A project with no scanning isn't safe. It's just unobserved.
What's free and what isn't
A lot of the useful layer is free if your code is public. Copilot Autofix is on by default for public repositories that use CodeQL, with no Copilot subscription needed (GitHub). GitHub made it free for all public repositories back in 2024 (GitHub changelog).
Semgrep's free edition covers up to 10 contributors and 10 repositories, with 60 AI credits included (Semgrep). Snyk's free plan allows five projects and 100 Snyk Code tests a month (Snyk), and the company also runs a program where open-source maintainers can apply for free access.
The paid edges are mostly about private code and agents. GitHub's newer agentic autofix, still in preview, uses AI credits, and Copilot Autofix on private repositories needs a Code Security license (GitHub). Codex Security needs access to the research preview (OpenAI docs).
How to opt in safely
Free doesn't mean free of consequences. A scanner that reads your code and sends reports to you has an effect on your workflow, your disclosure process and sometimes your reputation. A few steps keep that under control.
- Check the eligibility first. OSS Scanner wants projects with critical infrastructure or security impact, so read the criteria in Anthropic's repository before you spend time on a pull request.
- Decide where reports go. Use a private channel, such as GitHub's private vulnerability reporting or a security email address, so a finding isn't public before a fix exists.
- Name an owner. One person gets every report and decides what happens. Two people means each assumes the other one has it.
- Read the data terms of any hosted scanner. Semgrep, for example, says opted-in AI features may process the parts of files that contain findings (Semgrep). Know what leaves your machine.
- Start with read-only access, and keep patches as suggestions. No tool should push to your main branch.
- Write down your disclosure timeline before the first report arrives. It's much easier to follow a rule you wrote when you were calm.
None of this is exotic. It's the same hygiene a good maintainer applies to any outside researcher, applied before the volume arrives.
A workflow for a small team
If you're two to ten people shipping a product, you don't need an agentic scanner on day one. You need a queue you can actually empty. The loop below has six steps, and the amber one is where most teams skip ahead.
Replay is the step that separates a useful scanner from a noisy one. If a report has a reproducer, run it yourself. If it doesn't, ask for one. A model that can't show its claim working has given you a theory, and theories are cheap.
Not sure where to start? The decision tree below maps the common cases. It's editorial advice built on the vendor terms above, so adjust it to your situation.
For most small teams, the better first move is a free pull request scanner plus one person who owns the results. Add an agentic tool after that queue stays calm for a few weeks. A hobby repo can get by on the free defaults its host already offers. A library that sits on a critical path is the one that should apply for OSS Scanner.
Counting the cost of triage
Nobody puts triage time on the pricing page, and it's the cost that decides whether a scanner helps or hurts. Even a good tool produces some duplicates. Anthropic's own review found 11 in 97. The calculator below turns your report volume into hours.
Try pushing the invalid share up and see how fast the hours pile up. Then try cutting the minutes per report to 15, as a rough picture of what a working proof could save you (the number is an illustration, not a measurement). That gap is the argument for demanding reproducers, from AI tools and humans alike.
A few habits help once reports start landing. The graphic below sums them up.
The first pair deserves repeating. Severity ratings come from a model, and Anthropic itself warns they can be wrong (SiliconANGLE). Rate it yourself after you've replayed it. The Claude Code style of assistant can help you write the fix and the regression test once you have decided the bug is real, but the deciding stays with you. For wider context on that kind of tooling, see our coding assistants board and the guide to AI code review tools.
Where these tools still fall short
They're good at classes of bugs that leave a trail in the code: memory errors, injection, missing checks. They're weaker at flaws that depend on how a business actually works, such as who should be allowed to approve what. A scanner can't know your intent.
They also don't replace the rest of security. Google's CodeMender keeps humans reviewing patches before they go upstream (Google DeepMind), and GitHub says Autofix works on a best-effort basis and can't confirm that a fix resolves alerts from custom queries (GitHub). Vendors with the most to gain still tell you to check the output.
The honest limit is volume. Finding bugs is getting cheaper faster than fixing them. A scanner that hands a three-person project forty real findings has created a backlog, not a safer product. Pick tools by how much you can fix in a month, not by how much they can find.
Frequently asked questions
Is Anthropic's OSS Scanner open to any GitHub repository?
No. It's opt-in and evaluated case by case, with criteria similar to OSS-Fuzz, so projects need critical impact on infrastructure and user security. Maintainers apply through a pull request to Anthropic's GitHub repository.
Do AI scanners replace a penetration test?
Not for anything that matters to your customers. They cover code-level bugs well and business-logic flaws poorly. Treat them as an extra layer that runs all the time, alongside the occasional human review.
Can I use Claude or Gemini directly to audit my code?
You can paste code into Claude or Google Gemini and ask for a security review. It helps for a single function. It won't have the sandbox, the repo-wide threat model or the exploit check that the dedicated agents above add, so expect more false alarms.
What should I do if I get an AI-written report that looks fake?
Ask for a reproducer against a named version. A real finding can answer that question. A fabricated one often can't. If someone keeps sending them, you're allowed to close the report and move on.
Are free scanners safe to run on private code?
Read the terms for each one. Some run entirely on your own machine, and some send file portions to a hosted model. Check what the vendor stores and for how long before you connect a private repository.
