Anthropic's OSS Scanner gives maintainers Mythos-class bug reports for free, by email, unreviewed
On 8 October 2026 Anthropic announced the Cyber Mission. It starts with two programs. The OSS Scanner is a free, opt-in service that runs periodic vulnerability scans of open-source projects with Anthropic's strongest models, Claude Mythos among them. The Critical Infrastructure Defense Program (CIDP) puts frontier Claude models, on-site engineers and threat research inside 11 security firms that protect grids, water and transport.
This matters to maintainers because the scanner puts the output of Anthropic's gated cyber models on your repository without you having to apply for a gated tier. The catch is in the delivery: reports are model-generated, sent without human review, and arrive by email. It is not a CI check.
What actually shipped
The OSS Scanner (per the Frontier Red Team post, the FAQ and the anthropics/oss-scanner repo) is inspired by Google's OSS-Fuzz, but it uses language models instead of fuzzers. Each report contains a self-contained reproducer, an explanation (with a bisection to the introducing commit where possible) and a candidate patch where one is available. Outputs are "fully model-generated, without human review or triage." Anthropic warns that severity can be inflated and that the model can misread a project's threat model.
| Aspect | What Anthropic says |
|---|---|
| Scanning environment | Your project is built in an isolated VM from a Dockerfile you supply, then scanned with Internet access disabled. Anything the build or tests need has to be fetched during Dockerfile setup |
| Cadence | A first scan after enrolment, then periodic rescans. Frequency "may vary" with pipeline load and project popularity. No fixed interval is given |
| Delivery | An email bundle to a primary_contact, optionally PGP-encrypted |
| Disclosure | Unvalidated findings have no 90-day clock and are not made public. If a finding is later human-validated through Anthropic's CVD process, it may be disclosed 90 days after you're notified of that validation |
| Eligibility | Similar to OSS-Fuzz, meaning "critical impact on infrastructure and user security", judged case by case. Factors include project age, activity, OpenSSF criticality score, an open-source license and usage. Brand-new projects generally don't qualify, and the service is aimed at projects that can already handle high/critical reports |
| Cost | Free. It is funded by the Defender Advantage Fund launched in August |
CIDP (per the Cyber Mission post) has founding partners Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. It is aimed at providers (security vendors, integrators, equipment makers), who register through an interest form, rather than at operators directly. Anthropic says it is starting with a small cohort, and it doesn't name the model involved.
Numbers that matter
| Metric | Value (Anthropic, self-reported) |
|---|---|
| Candidate vulnerabilities from the CVD pipeline, 6 months | 29,000+ |
| Manually reviewed/triaged | ~6,000 |
| Reports sent to maintainers (incl. unvalidated, on request) | ~5,000 |
| Pen-tester check: critical/high findings that met the CVD bar | 85 of 97 (88%), across 48 projects |
| Of the remaining 12 | 11 real but duplicates, 1 false positive |
| wolfSSL early trial | 74 reports, all but 2 valid, 5 CVEs |
| Expected true-positive rate | "above 90%" |
Illustrative triage sizing (my numbers, not Anthropic's): say your first scan returns 30 reports. At 96/97 real (85 + 11), the strict false-positive rate is about 1%, so roughly 0.3 false reports. If duplicates run at the pen-test rate of 11/97 ≈ 11%, about 3 of the 30 are duplicates. That leaves around 26 genuinely new issues. At an assumed 2 engineer-hours each to confirm, patch and release, that is ~52 hours, or more than a week of one maintainer's time from a single email. Hence the eligibility bar.
The scanner puts the output of Anthropic's gated cyber models on your repository without you having to apply for a gated tier.
Technical meaning and trade-offs
Accuracy looks high, but the evidence is narrow. The 85/97 check covered only critical/high findings Anthropic selected, wolfSSL is one project, and all of it is self-reported.
The offline scan is a feature, and it costs you work. The model can't fetch your dependencies or reach the internet while it scans, which is good for containment. It also means your Dockerfile has to produce a hermetic build. Projects with network-dependent test suites will get build-failure emails instead of reports.
No embargo cuts both ways. Nobody starts a disclosure countdown on unreviewed output, but nobody is coordinating disclosure for you either.
Then there is the relation to the gated tiers. On 6 October Anthropic folded Project Glasswing into an expanded Cyber Verification Program. It has three tiers (Defense, Red Team and Specialized Access), each with Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1, and it requires data retention for misuse monitoring. The scanner turns that capability into a push service: Anthropic runs the model and you receive the output. If you want to drive these models yourself for triage or patching, open-source maintainers are explicitly eligible for CVP Defense Access. See gated cyber tiers across five labs for how this compares with the others.
What I'd do (as a maintainer)
First, check eligibility honestly. Does untrusted input reach your code, and is it widely depended on? If yes, enrol. If not, you still get human-verified reports through the normal CVD path.
Enrol through a PR that adds projects/{name}/project.yaml (repo, primary_contact, dockerfile; optionally auto_ccs, threat_model, pgp, disabled). Use a security alias, because the addresses are public.
Write threat_model.md. It is optional, but it is your only lever against inflated severity.
Keep the scanner build green in your own CI. There is no official CI integration, so add a job that builds your .oss-scanner/Dockerfile and runs the test suite with networking off (docker run --network none). Otherwise a dependency bump can quietly break your scans. The repo's tools/check {name} reproduces the scanner's build locally.
Route the email into a private tracker, not a public issue queue. Turn every confirmed reproducer into a regression test before you merge the patch.
Remember the OSS Scanner is periodic, not per-commit. For scanning in your own workflow, Anthropic points to its separate Claude Security product. For OpenAI's gated equivalent, see GPT-6 Astra.
Anthropic's 22 October formal-verification research is a separate, complementary effort and is covered in its own article.
What I couldn't verify
I couldn't confirm which model runs each scan: the research post says "including Claude Mythos", and the FAQ says only "our strongest models." Nor whether submitted code is used for training; the FAQ describes sandboxing and access controls but doesn't answer this. I don't know how many projects are enrolled, since the repo shows stars and PR counts but no project total. How CIDP partners pay, if they pay at all, is open too, and SiliconANGLE notes that this isn't stated. All accuracy figures are Anthropic's own. I found no independent replication.
I'll revisit once a few enrolled projects publish their own triage numbers.
Sources
Primary: Anthropic: Anthropic Cyber Mission; Anthropic: Launching an opt-in vulnerability-finding service for open source; Anthropic Frontier Red Team: OSS Scanner FAQ; GitHub: anthropics/oss-scanner; Anthropic: Cyber Verification Program. Coverage: SiliconANGLE: Anthropic launches critical infrastructure program and free OSS scanner.