Anthropic’s scanner finds 29,000 candidate bugs in open source, only 516 patched
On 11 October 2026, the disclosure dashboard behind Anthropic’s free open-source scanner showed its models surfaced more than 29,000 candidate vulnerabilities in six months, with just 516 patched upstream. If you maintain a critical project, the new “fast-track” now ships raw, unvalidated findings straight to you: sorting them is your job.
11 October 2026. The New Stack breaks down the results of Anthropic’s free open-source scanner. 29,000 candidate vulnerabilities surfaced over six months of scanning. 516 patched upstream. 2 October 2026. The program’s dashboard freezes the counters: 5,674 findings confirmed out of 6,123 reviewed. Why it matters: models now find flaws faster than humans can verify them, and the bottleneck has moved — it is no longer detection that is missing, it is maintainer capacity to fix.
Models that find, humans that cannot keep up
Anthropic’s disclosure program uses its models to scan the world’s most widely used open-source projects. Over six months they surfaced more than 29,000 candidate vulnerabilities. The human review pipeline, which relies on six external security research firms to reproduce and triage findings, has worked through only about 6,000 of them.
The dashboard puts numbers behind the problem. As of 2 October 2026, outside firms had confirmed 5,674 of the 6,123 findings they reviewed as valid, but only 516 vulnerabilities had been patched upstream. 6,157 findings were sent to maintainers, and 584 CVE or GitHub Security Advisory identifiers were issued — some findings received both. Roughly 23,000 candidates remain entirely unreviewed.
The conclusion is blunt and has nothing to do with laziness: automated detection has outrun processing capacity. A scanner that flags 29,000 issues is useless unless someone can say which are real, let alone fix them.
The “fast-track”: raw findings go straight to maintainers
Rather than make maintainers wait for its researchers to drain the backlog, Anthropic changed tack. Eligible projects now receive free, periodic scans powered by its top models, including Claude Mythos. Findings go directly to maintainers, with no human at Anthropic validating them first.
The company calls it an “optional fast-track.” It says projects that received its first reports kept asking for everything else it had, and it has already sent nearly 5,000 unvalidated reports to maintainers who requested them. The trust model is inverted: the researcher no longer filters; the maintainer sorts.
What the signal is worth, in numbers
The obvious question is the false-positive rate. Anthropic had the penetration testers who vet its coordinated disclosures check 97 critical- and high-severity findings that an early version of the scanner produced across 48 projects. 85 cleared the bar for disclosure; 11 of the remaining 12 were real bugs that duplicated known issues or other findings from the same scan. One was a false positive.
The number flatters, but read it carefully. It describes the scanner’s early output, not the 29,000 candidates from the separate disclosure program. It says nothing about lower-severity findings, or how the scanner will behave at scale. In its technical announcement, Anthropic acknowledged that maintainers have reported inflated severities and cases where the scanner misunderstood a project’s threat model.
What separates these reports from a classic SAST alert queue is how they are packaged. Anthropic says each includes a self-contained reproducer, an explanation that, where possible, identifies where the bug was introduced through bisection, and a candidate patch when the model can produce one.
Maintainers weigh in: real bugs, sometimes nearly done
The testimonials give the signal its weight. Todd Ouska, founder of wolfSSL, reports that 72 of the 74 reports his team received were valid and five became CVEs. Noah Misch, a PostgreSQL committer, says several reports arrived with fixes the project could use “nearly as-is,” and credits the fast-track with letting PostgreSQL address the newest issues before they shipped in a GA release.
The most pointed endorsement comes from Daniel Stenberg, founder of the cURL project. He spent last year publicly complaining about the flood of AI-generated slop hitting his bug bounty, which curl shut down in January. He now says the OSS Scanner found multiple issues in curl, including one of the worst vulnerabilities the project has seen reported in recent years.
Anton Arapov, director of OpenSSL Corporation, adds that the reports sent — raw model output included — match the level expected of a serious disclosure.
The frame: isolation, eligibility, and no 90-day clock
The setup is bounded. Anthropic builds each project in an isolated VM and cuts off internet access before scanning begins. Reports go to maintainers by email, and they can pause or opt out at any time. The GitHub repository contains the enrollment and configuration tools, but not the scanner itself.
Access is limited to established projects that can absorb the volume. Eligibility follows OSS-Fuzz-style criteria — widely used, security-critical open-source software. Anthropic verifies that applicants are core maintainers, and its FAQ says participating projects should already be keeping up with the high- and critical-severity findings reported to them.
The disclosure terms let maintainers work at their own pace. Unvalidated scanner findings carry no 90-day clock. A report the company later validates through its standard program, however, can be disclosed 90 days after the maintainer learns a human has confirmed it.
There is also a small economic nudge. Eligible maintainers can get free Claude Max 20x subscriptions through the Claude for OSS program, meant to help projects keep pace with the growing number of findings. Anthropic is honest about the limit: free access to Claude does not give a maintainer more hours in the day to review and ship fixes — which is the real constraint, not tooling.
Why maintainers burned out on AI slop first
The scanner’s reception only makes sense against what came before it. In early 2026, Daniel Stenberg shut down curl’s bug bounty program after being buried under a flood of low-quality, AI-generated vulnerability reports. He was not alone: maintainers across the ecosystem complained that language models were producing plausible-looking reports with no reproducer, no patch and no grasp of a project’s threat model.
Anthropic’s scanner is, in part, a deliberate answer to that backlash. Its packaging — a self-contained reproducer, a bisection traceback where possible, a candidate patch — is designed to be the opposite of the slop that burned maintainers out. The endorsements from Stenberg, Ouska and Misch are not incidental: they are the target audience vouching that the signal has changed.
That history also explains the fast-track’s design tension. Sending unvalidated findings straight to maintainers risks recreating the very flood that burned them out. Anthropic’s answer is eligibility: only widely used, security-critical projects with core maintainers who can absorb the volume get in, and anyone can pause or opt out. The scanner has to keep proving it is not the slop it was built to replace.
Verdict
If you maintain a widely used, critical open-source project, sign up for the fast-track — but know what you are accepting: a stream of raw, unvalidated findings, the large majority of which will be real, that you must triage against your own priorities. If you are a security leader consuming these libraries, do not read “516 patched out of 29,000” as a scanner failure: it is proof that fixing capacity, not detection, has become your bottleneck, and that your dependency patching must be automated to keep pace. If you are building your own AI scanner, remember the packaging that makes the difference: a reproducer, a bisection and a candidate patch beat a thousand context-free alerts.