Anthropic offers free security scan for open source

Anthropic has announced that its advanced AI models are available for free to scan for security vulnerabilities in open source software. This new service, called OSS Scanner, provides regular scans for major software projects, including detailed reports on discovered vulnerabilities and possible solutions. Alerts are generated completely automatically by AI without human intervention, which brings both opportunities and challenges in assessing the accuracy of these alerts.

The OSS Scanner has been developed as part of the Anthropic Cyber Mission and is inspired by Google’s OSS-Fuzz, which has been testing open source code for bugs for years. Projects participating in the scanner are regularly screened using Anthropic's powerful models, such as Claude Mythos. The reports generated contain information about the vulnerabilities, including how they can be exploited and suggestions for repairs. However, there is an acknowledgment from Anthropic that some alerts may be false, highlighting the importance of human assessment, especially in the case of critical vulnerabilities.

In the past six months, the OSS Scanner has discovered more than 29,000 potential security vulnerabilities, with nearly 5,000 alerts sent to software developers. A team of experienced security testers has verified these alerts with a substantial degree of accuracy. Moreover, Anthropic is not only focusing on software but also on the security of critical infrastructure such as energy and water supplies, in collaboration with multiple security companies.

For European software developers, the launch of the OSS Scanner is particularly relevant given the recently introduced reporting obligation for vulnerabilities under the European Cyber Resilience Act. This provides an opportunity for open source projects to proactively identify and address vulnerabilities, which is crucial in today’s digital landscape. The scanning service aligns with broader trends in cybersecurity, where AI is playing an increasingly prominent role in detecting and mitigating security vulnerabilities.

Read the full article from AI Insider.