Anthropic's bug scanner floods maintainers with 29,000 findings; only 516 patched so far

Anthropic launched its OSS Scanner last week as part of a broader Cyber Mission, revealing a critical imbalance in its vulnerability research pipeline. The tool's speed at uncovering potential bugs now vastly outpaces the capacity of human teams to validate and coordinate disclosure of those findings.

Over a six-month period scanning widely deployed open source projects, Anthropic's models identified more than 29,000 candidate vulnerabilities. The company's human review process, which depends on six external security research firms to reproduce and categorize the results, has processed only about 6,000 of those candidates.

A public disclosure dashboard illustrates the scale of the challenge. As of October 2, external security firms had validated 5,674 of the 6,123 findings they examined as genuine vulnerabilities, yet only 516 had received upstream patches. Anthropic transmitted 6,157 findings to maintainers, leading to 584 CVE and GitHub Security Advisory identifiers, with some findings generating both. Roughly 23,000 candidates remain in the queue awaiting human review.

Claude is finding potential vulnerabilities faster than human researchers can verify them.

How the fast track works

Rather than requiring maintainers to wait while Anthropic's team processes its backlog, the company offers eligible projects complimentary, recurring scans using its leading models, including Claude Mythos. These findings reach maintainers directly, bypassing Anthropic's internal validation step.

Anthropic reports that projects receiving initial reports frequently requested access to all remaining findings, prompting the company to dispatch nearly 5,000 unvalidated reports to maintainers who asked for them. This arrangement is now marketed as an "optional fast-track."

Bypassing the backlog

Experienced penetration testers responsible for vetting coordinated disclosures reviewed 97 critical and high-severity findings from an early scanner version across 48 projects. Eighty-five met the threshold for disclosure, while 11 of the remaining 12 represented genuine bugs that either duplicated known issues or overlapped with other scan results. Just one was determined to be a false positive.

These metrics reflect the scanner's initial performance, not the 29,000 candidates from Anthropic's separate disclosure initiative. The sample provides limited insight into lower-severity findings or how the tool scales. Anthropic's technical documentation acknowledged that maintainers have flagged inflated severity classifications and instances where the scanner misinterpreted a project's threat model.

What maintainers are reporting

What distinguishes these reports from standard SAST tool output is their presentation. Anthropic includes a self-contained reproducer, an explanation that identifies where the bug was introduced when feasible through bisection, and a candidate patch when the model can generate one. Anton Arapov, director of OpenSSL Corporation, noted that the reports Anthropic sent, including raw model output, matched and occasionally surpassed what the project receives from human researchers. He observed that a report with a working exploit "basically job done for an engineer as you can verify it right away."

Todd Ouska, founder of wolfSSL, stated that 72 of the 74 reports his team received were valid, with five becoming CVEs. PostgreSQL committer Noah Misch reported that several reports arrived with fixes the project could apply "nearly as-is." Misch also noted that fast-track access enabled PostgreSQL to address emerging issues before they appeared in a GA release.

The most striking endorsement came from The cURL Project founder Daniel Stenberg, who spent the previous year publicly criticizing the deluge of AI-generated noise reaching his project's bug bounty, which curl discontinued in January. He now states that OSS Scanner uncovered multiple issues in curl, including one of the most severe vulnerabilities the project has encountered in recent years.

Anthropic builds each project in an isolated VM and disables internet connectivity before scanning starts. Reports travel directly to maintainers via email, and they retain the ability to pause or withdraw at any time. The GitHub repository provides enrollment and configuration utilities, though the scanner itself remains unavailable there.

Finding bugs versus fixing them

A reproducer and proposed patch can reduce effort, but maintainers must still validate the fix, manage backports, and deploy it, occasionally knowing the change will alter behavior that users depend on—a tradeoff OpenSSH's maintainers accepted when they intentionally disabled two features for security reasons.

Anthropic is limiting access to established open source projects possessing the infrastructure to absorb additional vulnerability reports. Projects must satisfy OSS-Fuzz-style eligibility standards, and Anthropic verifies that the applicant is a core maintainer. The company also expects participating projects to be managing the high- and critical-severity vulnerabilities already disclosed to them.

Who gets OSS Scanner access?

The service is designed for projects equipped to manage the workload. Eligibility adheres to OSS-Fuzz-style criteria targeting widely used, security-sensitive open source software. Anthropic confirms that applicants are core maintainers, and its FAQ indicates that participating projects should already be addressing verified high- and critical-severity reports.

The disclosure framework allows participating maintainers flexibility in their response timeline. Unvalidated scanner findings are not subject to a 90-day disclosure window. However, a finding that Anthropic later validates through its standard program can be disclosed 90 days after maintainers are notified that a human has confirmed it.

Anthropic states it may eventually impose a disclosure period on certain high-severity scanner findings after notifying projects and offering them the option to decline.

Eligible maintainers receive complimentary Claude Max 20x subscriptions through Claude for OSS. The goal is to assist projects in managing the rising volume of findings, but free Claude access does not expand the time maintainers have available to review and release fixes. As other AI-assisted coding initiatives have demonstrated, code that passes compilation can still harbor defects requiring human scrutiny.