VulnCheck

Headlines · 1

1. 6d
   Anthropic's free OSS Scanner: who audits the auditor?

   On Oct 8, 2026, Anthropic launched two free arrangements under the name Anthropic Cyber Mission: the Critical Infrastructure Defense Program (CIDP), which puts frontier Claude models, embedded engineers and threat research behind 11 founding partners including Accenture, CrowdStrike, Deloitte, Palo Alto Networks, PwC and Rockwell Automation to protect power-grid, water and transport OT systems; and OSS Scanner, a free opt-in service using Anthropic's strongest models, including Claude Mythos, to scan open-source projects. The piece says the models found over 29,000 candidate vulnerabilities in six months, with only about 6,000 human-reviewed and nearly 5,000 unverified reports plus candidate patches sent straight to maintainers, and that fast-track findings are neither subject to a 90-day disclosure window nor published. It argues the structural problem is one company being model vendor, open-source auditor, critical-infrastructure gatekeeper and arbiter of what counts as a vulnerability, citing VulnCheck's September comparison in which Claude rated 91.5% of findings high or critical versus maintainers' 51.3%.

   钛媒体 · 🔥 0

Experience and discussion from the community

Share my VulnCheck experienceAsk about VulnCheck