Anthropic on Thursday unveiled OSS Scanner as an opt-in vulnerability scanner to help secure the open-source ecosystem using artificial intelligence (AI).
"It's an opt-in service informed by our experience using Claude to find vulnerabilities during Project Glasswing," Anthropic said. "Projects that join will receive thorough, periodic security scans by our strongest models at no cost."
Interesting development. I've been using AI to help with security checks on systems I actually run, including my Oracle server and a Kali test setup.
The biggest lesson so far is that identifying a possible vulnerability and proving you've improved security are two different jobs.
For example, an Nmap scan in my own Kali lab showed rpcbind exposed. I disabled both the service and its socket, then repeated the scan to confirm the port was no longer open.
That's what I'd want from an AI vulnerability scanner: clear evidence for each finding, a way to reproduce it, sensible prioritisation, human approval before anything changes, and a follow-up check to verify the fix.
If this makes open-source security work more accessible without creating a mountain of false positives, it could be genuinely useful. I'd be interested to see how reliably it separates actual risks from noisy findings.
This will be amazing fr.