ข้อมูลสำคัญ
Anthropic has introduced OSS Scanner, a service utilizing its Claude Mythos model to inspect open-source software for security vulnerabilities. Within its first 11 days, the AI identified 77 vulnerabilities classified as critical and 803 as high severity. The service operates by analyzing projects submitted by maintainers within an isolated sandbox environment, providing reproduction code and potential patches at no cost.
The tool functions without human review, allowing for rapid, frequent scanning. Anthropic acknowledges that this approach may result in false positives or misinterpretations of project threat models. While initial tests showed 88% of reports met disclosure standards, some maintainers have reported that the AI tends to assign overly high severity ratings.
A notable discovery includes CVE-2026-92392 in the curl library, a use-after-free vulnerability identified by the scanner. Daniel Stenberg, who leads curl development, described it as one of the most severe issues the project has faced in recent years. Although remote code execution is theoretically possible, curl developers noted the conditions are strict and a crash is the most likely outcome.
OSS Scanner is currently available for selected projects, with 114 accepted out of approximately 650 applications. Unlike traditional coordinated disclosure, these reports are not publicly released, and no standard 90-day deadline is applied. Anthropic intends for this service to help maintainers address security flaws faster than attackers can exploit them.
