Crypto companies turn to Anthropic AI to discover security vulnerabilities

Ethereum developer Nethermind and Bitcoin Wallet ZEUS applied to use Anthropic's ai security scanner

Several cryptocurrency companies, including Ethereum developer Nethermind and Bitcoin Wallet ZEUS, have applied to access the new ai security scanning service launched by Anthropic. The service leverages the Claude Mythos model and is designed to identify potential security weaknesses in software before attackers exploit vulnerabilities.

Project background and application status

Nethermind and ZEUS both submitted access requests to Anthropic's free security scanning service. Anthropic said its scanner runs based on Claude Mythos technology and can automatically send vulnerability reports without manual review. Among them, Nethermind mainly requests scanning its code warehouse, while ZEUS seeks security checks covering modules such as payment processes, private key management and Lightning network connections.

So far, Anthropic has discovered approximately 29,000 candidate vulnerabilities, but only approximately 6,000 have been manually reviewed internally. On October 8, Anthropic officially launched a free open source software (OSS) scanner that allows eligible open source projects to receive automatically generated security vulnerability reports. An application filed immediately after October 9 showed that developers in the crypto space are showing strong interest in using advanced ai tools to review code involving transactions, private keys and blockchain infrastructure.

Specific application details

该项目延续了Anthropic此前“Glasswing计划”的思路，该计划曾向特定组织开放强大的ai模型以支持网络安全研究。与现有的披露流程不同，这项新服务将直接发送发现的问题，而无需等待人工验证。

• Nethermind：作为首批寻求加入的区块链项目之一，Nethermind于周五提交了GitHub拉取请求（PR #38）。该应用请求对其整个代码库进行安全扫描，其团队维护的软件用于与以太坊网络交互。Nethermind开发的以太坊执行客户端负责处理区块链交易并支持网络运营。若获批准，该团队将获得由ai生成的报告，以识别代码中潜在的弱点。
• ZEUS：这款比特币及Lightning钱包提交了独立申请，要求对其移动应用程序以及处理支付、私钥和Lightning连接的核心组件进行检查。作为一款自我托管钱包，它允许用户在保留资金控制权的同时管理比特币。
• VirtEngine：这一基于Cosmos SDK构建的去中心化云计算市场也通过GitHub提交了加入请求。该项目致力于去中心化计算服务的基础设施建设，其软件同样是扫描器的潜在适用对象。

审核机制与评估标准

The current application is only a participation request and does not mean that the relevant project has completed the safety audit. Anthropic will evaluate submissions on a case-by-case basis, taking into account factors such as the project's importance to the infrastructure, exposure to remote attacks, and the reliance of other systems on the software. Other applicants include ai assistants , developers of security tools, machine learning infrastructure and cloud storage systems. Anthropic has not announced a specific timetable for approving cryptocurrency projects or delivering the first report.

ai Effectiveness and challenges of the scanner

Anthropic developed the OSS Scanner because it discovered that the speed at which the ai model identified software defects far exceeded the speed of manual review by researchers. In the past six months, the company's model has identified more than 29,000 candidate vulnerabilities in widely used open source projects. Researchers only manually reviewed about 6,000 results, resulting in a large backlog to be evaluated.

To this end, Anthropic introduced an automated system that sends reports directly to participating maintainers. The company said the service will use its strongest models, including Claude Mythos, to generate findings and fix recommendations. "These reports will be generated by our strongest models," Anthropic pointed out in the announcement.

Unlike traditional security audits that require manual review, OSS Scanner generates reports without verification. Anthropic acknowledged that some of the findings may contain inaccuracies, such as erroneous severity ratings or vulnerabilities that do not apply to the project's security design. But in early testing, external penetration testers reviewed 97 high-risk and serious findings in 48 projects. The results showed that approximately 85 findings (approximately 88%) met the criteria for coordinated vulnerability disclosure. Of the remaining 12 findings, 11 were real issues (duplicate existing reports or known vulnerabilities), and only one was invalid.

The scanner provides replicable examples of vulnerabilities, explanations of affected code, and available patch recommendations. Participating encryption developers need to review these findings themselves before deciding whether modifications are needed. For projects that cannot process a large number of automated reports, Anthropic will continue to provide a manually reviewed vulnerability disclosure process.

Industry Security Background

This release comes as the blockchain industry is facing serious security challenges due to attacks involving automated tools or suspected ai-assisted. In August this year, Bitcoin swap service provider Boltz suspended operations after months of ai assisted attacks. The company said attackers can identify vulnerabilities faster than developers can investigate and fix them. Although Boltz's self-custody design did not lead to the exposure of client funds, the company still incurred operating losses.

The outage affected services that rely on Boltz's infrastructure, including ZEUS Wallet. ZEUS temporarily disabled swaps and took part of its infrastructure offline for review after another cybersecurity incident. In addition, during an approximately 30-hour ai auxiliary code review conducted by the "Bitcoin Red Team" in August, 4,962 potential vulnerabilities in 390 bitcoin-related projects, of which 720 were classified as high or severe severity, but these reports still need to be verified to be confirmed as actual vulnerabilities.

Anthropic expands ai access to cybersecurity tools

OSS Scanner is part of Anthropic's "Anthropic Cyber Mission" announced on October 8 to support software security and critical infrastructure protection. At the same time, Anthropic has launched the Critical Infrastructure Defense Program, which provides ai models, engineering support and threat research to organizations protecting power grids, transportation networks and industrial systems. The initiative has established partnerships with multiple cybersecurity and technology companies such as CrowdStrike, Accenture, Deloitte, and Palo Alto Networks.

For open source developers, Anthropic will provide free regular security scans for approved projects. Maintainers can apply for membership using the published template through the GitHub repository of OSS Scanner. Qualification assessments will consider the project's "critical impact" on infrastructure and user security, as well as the team's ability to review and handle reported vulnerabilities. Anthropic has not disclosed how many encryption projects it will ultimately accept, approved maintainers will receive reports generated by the model through the service, and the company continues to provide manual review disclosure services through existing processes.