Anthropic OSS Scanner is free for accepted projects—but maintainers own triage
Anthropic launched an opt-in vulnerability-finding service on 8 October. Accepted open-source projects receive raw model reports; these are not human-validated findings. Maintainers must assess reports and candidate patches before acting.
By Benedict Felix · Updated 8 October 2026
What this changes for UK buyers
Free scanning can still create a review workload. Decide who will reproduce findings, evaluate suggested changes and communicate confirmed vulnerabilities before enrolling a critical dependency.
What buyers should do
Confirm that a core maintainer controls the enrolment; Name a triage owner and set review capacity; Reproduce findings before classifying severity; Test every patch against the project threat model; Confirm disclosure, pause and data-handling rules
Primary announcement
Official announcement — 8 October 2026 ↗This is a dated source-linked buyer briefing. A vendor announcement does not prove UK account eligibility, an independent performance result or regulatory compliance. Open the primary source and confirm the exact plan before changing a production workflow.
Related profiles
Evidence standard · Commercial disclosure · Send a correction