Anthropic's free OSS Scanner accepts 114 projects, now encrypts every report

If you maintain an established, security-critical open source project, you can ask Anthropic to scan it for free with its strongest models, and every report now arrives encrypted. The enrollment steps are below. What's new is the first public scorecard: Anthropic's OSS Scanner product manager, Punit Shah, who calls himself "Pm on oss scanner" in a reply, posted on Monday that about 650 projects have applied in the 11 days since launch and 114 were accepted.

What changed#

Anthropic launched OSS Scanner on Oct 8 in a research post and promoted it from its @ClaudeDevs account at 5:47 PM ET Monday. It sends maintainers model-written bug reports with no human review in between, each with a reproducer and, when available, a candidate patch. Shah's thread gave the first numbers and three changes:

	At launch (Oct 8)	Oct 19 update
Projects	Validated "with dozens of open source projects"	About 650 applied, 114 accepted
Findings	97 critical and high findings checked by Anthropic's testers in a pre-launch audit	77 critical and 803 high model-rated findings reported
Delivery	Email, encrypted only if a maintainer supplied a key	All reports encrypted; a GitHub Security Advisories pilot
Acceptance rules	Case by case, OSS-Fuzz style	FAQ rewritten to spell out rejection reasons

Shah explained the encryption change: "An unexpected learning: it turns out emailing vulnerability proof-of-concepts (PoCs) gets your email rejected, so most of the reports we first sent bounced." He added: "Now, all reports arrive encrypted."

Why it matters#

The curl project shows what a hit looks like. Its advisory for CVE-2026-92392, an HTTP/2 upload use-after-free rated High, credits "Luna with Claude, Anthropic." Shah says an early version of OSS Scanner found it. curl maintainer Daniel Stenberg wrote: "In the curl 8.23.0 release we shipped a fix for one of the worst vulnerabilities in curl in a long time." He also wrote: "The most likely outcome of an attempted attack is rather just a crash." Versions 8.12.0 through 8.22.0 are affected, so if you ship software that bundles curl or libcurl, check your version even if you never enroll anything.

For maintainers, the trade is speed for noise. Anthropic's own pre-launch audit found that 85 of 97 critical and high findings (88%) met the bar of its human-reviewed disclosure process. The 77 and 803 counts are model-rated, not checked.

How to enroll#

1. Check eligibility in the FAQ. Anthropic accepts "established projects that have a critical impact on infrastructure and user security," borrowing OSS-Fuzz's wording.
2. Open a PR to anthropics/oss-scanner adding projects/<project>/project.yaml with repo, primary_contact and a Dockerfile path. The Dockerfile must build your project so the scan can run with no internet access.
3. Optionally add a threat model at .oss-scanner/threat_model.md. This prompt (ours, untested) drafts one with any coding agent:

Draft a threat_model.md for OSS Scanner for this repository. Cover which inputs are attacker-controlled, which code is in and out of scope, a critical/high/medium/low severity rubric for this project, and whether patches should be minimal or merge-ready. Base it only on the code and docs in this repo, and list anything you had to guess.

4. Run tools/validate.py and build the Dockerfile locally before you open the PR.

Good to know#

• Expect a wait. Shah wrote on X: "We’re working through much more interest than I personally expected, I think there are still over 150 projects awaiting a decision." When we checked at 2:45 PM ET Wednesday, the repo showed 346 open pull requests, up from 247 at our 6:12 AM ET check Tuesday. That count includes any open pull request, not only enrollments.
• Young projects are turned away. Shah listed the most common rejection reasons as a non-open-source license and projects that "aren’t sufficiently established or critical." The FAQ says brand new projects "do not typically qualify."
• No disclosure clock, for now. The FAQ says: "We will not place any form of 90-day coordinated disclosure period on these unvalidated findings." Anthropic says it may add one for some high-severity reports later, with notice and an opt-out.
• A PGP key costs you CCs. "If you include a GPG key then you cannot include additional CCs; mail will only go to the primary email address."
• Pausing is a PR. Add disabled: true to your config to stop reports.

What to watch: whether the GitHub Security Advisories pilot becomes the default delivery, how fast the 150-project queue clears, and whether Anthropic adds the disclosure window it describes as possible.