Anthropic's free open-source bug scanner emails reports with no human review

Anthropic has launched its Cyber Mission, in two parts.

• Critical Infrastructure Defense Program: models, on-site engineers and threat research for people defending industrial and operational systems, with 11 founding partners including CrowdStrike, Dragos, Palo Alto Networks, Rockwell Automation and Hitachi.
• OSS Scanner: a free, opt-in service that runs Anthropic's strongest models over enrolled open-source projects and emails each finding to the maintainers, with a proof of concept and a suggested fix.

Anthropic's own page admits its Glasswing effort "hasn't yet achieved a sufficient reduction in cyber risk".

The small print

• Reports go out with no human reading them first. The forecast is that more than 90% will be real.
• There's no 90-day disclosure clock, and no public advisory unless a person validates the finding later, so the tools everyone else relies on may never hear about the fix.
• The Register notes that maintainers' inputs and outputs may be used for training under consumer terms.
• Cybersecuritynews reports more than 29,000 candidate vulnerabilities from six months of scanning, about 6,000 of them checked by hand.

Why it matters

The tenth report lands in a volunteer's inbox looking exactly like the other nine. Finding bugs has become cheap. Reading the reports still falls to a person.