Runtime’s Tom Krazit argues that Anthropic’s new OSS Scanner, an opt-in vulnerability scanner for open source projects informed by the company’s use of Claude during Project Glasswing, solves one problem while creating another. Anthropic said it has been scanning most of the larger open source projects since the launch of Claude Mythos Preview but remains bottlenecked on the human capacity to validate findings and scrub out false positives, so the free service instead sends maintainers a list of unverified vulnerabilities to sort through themselves. The newsletter says that dumps significant work on maintainers who were already scrambling to keep up with a surge of vulnerabilities made easier to find and exploit by frontier cybersecurity models, and notes the move drew criticism on the argument that a company that cannot afford to verify every finding its models produce is shifting that burden onto under-resourced projects.
Anthropic's free OSS Scanner shifts vulnerability verification onto maintainers
Runtime's Tom Krazit argues that Anthropic's new OSS Scanner, an opt-in vulnerability scanner for open source projects informed by the company's use of Claude during Project Glasswing, solves one problem while creating another. Anthropic said it has been scanning most of the larger open source projects since the launch of Claude Mythos Preview but remains bottlenecked on the human capacity to validate findings and scrub out false positives, so the free service instead sends maintainers a list of unverified vulnerabilities to sort through themselves. The newsletter says that dumps significant work on maintainers who were already scrambling to keep up with a surge of vulnerabilities made easier to find and exploit by frontier cybersecurity models, and notes the move drew criticism on the argument that a company that cannot afford to verify every finding its models produce is shifting that burden onto under-resourced projects.
Source: Thestack