Anthropic’s new OSS Scanner, launched last week as part of its broader Cyber Mission, exposes a problem inside the company’s security research operation. Claude is finding potential vulnerabilities faster than human researchers can verify them.

Over six months of scanning some of the world’s most widely used open source projects, Anthropic’s models surfaced more than 29,000 candidate vulnerabilities. Its human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000.

A disclosure dashboard puts some numbers behind the problem. As of October 2, outside security firms had confirmed 5,674 of the 6,123 findings they reviewed as valid, but only 516 vulnerabilities had been patched upstream.

The company sent 6,157 findings to maintainers, and 584 CVE and GitHub Security Advisory identifiers were issued, though some findings received both. Roughly 23,000 candidates remain unreviewed.

Claude is finding potential vulnerabilities faster than human researchers can verify them.

Instead of making maintainers wait for its researchers to work through the backlog, Anthropic is giving eligible projects free, periodic scans powered by its top models, including Claude Mythos. The findings go directly to maintainers, without anyone at Anthropic validating them first.

Anthropic says projects that received its first reports increasingly asked for everything else it had, and it has already sent nearly 5,000 unvalidated reports to maintainers who requested them. The company now calls the arrangement an “optional fast-track.”

Expert penetration testers who vet its coordinated disclosures were asked to check 97 critical and high-severity findings that an early version of the scanner produced across 48 projects.

Source link