Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).

"It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."

Anthropic also noted that the outputs of the scanner will be fully model-generated and do not require human review or triage, thereby facilitating faster and more frequent scanning. These reports are expected to be generated by its strongest models, including Claude Mythos.

The company pointed out that it expects to use a set of criteria similar to Google's OSS-Fuzz to pick projects, while emphasizing that the process may evolve over time. Project maintainers are advised to provide a short description explaining the importance of their project in cases where "it is not already self-evident."

Core maintainers of a project can enroll by opening a pull request on the OSS Scanner's GitHub repository along with a YAML configuration file that provides the following information -

"The Dockerfile configures the environment that the project will run in and installs all dependencies so that the agent can perform its security audit without any internet access," Anthropic said. "We recommend verifying that the test cases pass inside of the built container."

Other optional details that can be added to the YAML file are below -

As of writing, a total of 116 pull requests have been submitted. Unlike other vulnerability reporting programs, Anthropic said it does not intend to impose a 90-day disclosure period on the findings, given the risk that they may contain false positives.

Source link