Anthropic's free AI bug scanner caught one of curl's worst flaws in years, and 77 'critical' findings in its first scans

Anthropic says OSS Scanner, its free AI security scanning service for open-source projects, has already sent maintainers 77 critical and 803 high-severity findings from its first scans.

"The first scans have already reported 77 critical and 803 high model-rated findings to maintainers, and we're still scanning more projects," Anthropic's ClaudeDevs account posted on X on Oct 19. The post passed 10,700 likes and 750,000 views. The severity ratings come from the model, not human reviewers.

The headline catch is curl, the tool countless apps and devices use to move data over the internet. An early version of OSS Scanner found an HTTP/2 upload use-after-free bug (CVE-2026-92392), fixed in curl 8.23.0 on Oct 14. curl lead developer Daniel Stenberg called it "one of the worst vulnerabilities in curl in a long time," noting a malicious server meeting a narrow set of conditions could turn it into remote code execution. Versions 8.12.0 through 8.22.0 are affected.

Anthropic launched OSS Scanner on Oct 8. Enrolled projects get periodic scans from its strongest models, including Claude Mythos, with a reproducer and a candidate patch attached. Reports skip human review, so some may be wrong. Anthropic says it found about 29,000 candidate vulnerabilities over six months but could manually review only about 6,000.