Anthropic launches free open-source vulnerability-scanning service, saying AI it has identified more than 29000 suspected vulnerabilities

AT A GLANCE

Anthropic says it AI has identified more than 29000 suspected vulnerabilities in open-source software and has launched a free scanning service.

Article

Anthropic offers Claude free of charge to scan open-source vulnerabilities, finding more than 29000 suspected vulnerabilities

Beating AI news reports that Anthropic has launched its cybersecurity initiative, Anthropic Cyber Mission, along with a free vulnerability-scanning service,OSS Scanner, and a critical-infrastructure defense program. The former uses advanced models, including Claude Mythos, to regularly identify security vulnerabilities in eligible open-source software. The latter helps power grids, water plants, and transportation systems defend against cyberattacks.

Over the past 6 months, Anthropic has used AI to identify more than 29000 suspected vulnerabilities in open-source software, but has only had time to manually review approximately 6000 of them. The new service allows project maintainers to receive reports that have not been manually reviewed. Each report includes steps to reproduce the vulnerability, an explanation of the issue, and remediation recommendations. Anthropic expects that the proportion of genuine vulnerabilities will exceed 90%, but acknowledges that false positives may still occur.

The new service currently requires project maintainers to apply proactively and is primarily intended for important open-source projects capable of handling large volumes of vulnerability reports. Anthropic's prior testing involved projects including PostgreSQL and OpenSSL. Of the 74 reports received by wolfSSL, 72 were valid, and 5 vulnerabilities received CVE identifiers.

For infrastructure, Anthropic has partnered with 11 companies, including CrowdStrike, Accenture, and Hitachi. The company will provide partners with Claude models, on-site engineers, and security research support to help them inspect and remediate vulnerabilities for power, water, and transportation operators. These industrial systems are often difficult to shut down for updates, so actual remediation still requires professional involvement.

Original link https://m.theblockbeats.info/flash/370953

Key points

Anthropic launches its cybersecurity initiative, “Anthropic Cyber Mission,” and introduces the OSS Scanner free vulnerability-scanning service.
Over the past 6 months, Anthropic used AI to identify more than 29000 suspected vulnerabilities in open-source software, manually reviewing approximately 6000 of them.
OSS Scanner allows maintainers of eligible open-source projects to receive vulnerability reports that have not been manually reviewed.
Each report includes steps to reproduce the vulnerability, an explanation of the issue, and remediation recommendations.
Anthropic expects that the proportion of genuine vulnerabilities will exceed 90%, but acknowledges that false positives may still occur.
Testing involved PostgreSQL, OpenSSL, and wolfSSL; of the 74 reports received by wolfSSL, 72 were valid, and 5 vulnerabilities received CVE identifiers.
Anthropic has partnered with 11 companies, including CrowdStrike, Accenture, and Hitachi, to help power, water, and transportation operators inspect and remediate vulnerabilities.

AI-assisted interpretation

The following is analysis, separate from reported facts. Verify important claims independently.

Anthropic provides a service that automatically scans open-source software for vulnerabilities. Maintainers may apply to receive reports, but some reports have not yet been manually reviewed and therefore still require their own confirmation and handling.

Why it matters to readers

This could expand vulnerability discovery in open-source software and enable maintainers to obtain reproduction and remediation information more quickly; however, false positives and an excessive volume of reports may increase the handling burden.

Open-source software is used by many products. Vulnerability scanning can help identify security issues, but scan results do not constitute confirmed vulnerabilities and still require verification by professionals.

Risks and unknowns

The material does not provide an official Anthropic announcement or independent verification.
Of more than 29000 suspected vulnerabilities, only approximately 6000 have been manually reviewed.
That the proportion of genuine vulnerabilities exceeds 90%is Anthropic's estimate; the material does not provide complete validation results.
Information not specified 11 The complete list of partner companies and specific project outcomes.
The actual remediation of infrastructure vulnerabilities still requires professional involvement.

Anthropic launches free open-source vulnerability-scanning service, saying AI it has identified more than 29000 suspected vulnerabilities

Article

AI-assisted interpretation

Why it matters to readers

Risks and unknowns

Related Developments

Related concepts

Keep following

Security Center