Anthropic Fast-Tracks AI Bug Reports to OSS Maintainers, Taps 11 Firms for OT Security

Anthropic launched unreviewed AI vulnerability reports for OSS maintainers and an OT security program with 11 firms.

Anthropic announced OSS Scanner, a free service that uses its strongest models to periodically scan opted-in open source projects and email maintainers model-generated vulnerability reports without human review. Each report describes the flaw, includes a proof of concept, and suggests a fix when one is available; Anthropic expects a true-positive rate above 90 percent but warns some findings will be inaccurate. Separately, the Critical Infrastructure Defense Program gives frontier Claude models, on-site engineers, and threat research to 11 founding partners that secure operational technology for power, water, manufacturing, and transportation. Anthropic said Glasswing findings often took months to patch and that some OT fixes can take years because systems cannot be taken offline.

• OSS Scanner sends unreviewed AI vulnerability reports, PoCs, and suggested fixes to opted-in maintainers.
• Anthropic expects a true-positive rate above 90 percent but warns some severity ratings will be wrong.
• Projects that cannot triage at scale still get human-verified disclosures.
• CIDP pairs Claude and on-site engineers with 11 OT security and industrial partners.
• OT flaws can stay unpatched for years because systems often cannot be taken offline.