Encryption team submits Anthropic AI security scanner proposal

Anthropic launched an open source vulnerability reporting service, and encryption projects are competing to apply to access

Ethereum client developer Nethermind and cryptography-related organizations such as Bitcoin and Lightning wallet ZEUS, and have applied to join a new security service launched by artificial intelligence company Anthropic. The program, called "OSS Scanner," aims to help open source projects identify security risks earlier before attackers exploit vulnerabilities.

Anthropic officially launched OSS Scanner on Thursday and invited open source maintainers to voluntarily participate in the vulnerability reporting mechanism on Friday. The service leverages Anthropic's most powerful models, including Claude Mythos, to generate security discoveries that allow participating projects to patch code faster. According to Anthropic, after scanning the code, it will review the repository and provide reports to the registered project team.

Core Points

• OSS Scanner is a voluntary vulnerability reporting service designed to accelerate the process for open source teams to discover and fix security vulnerabilities.
• Anthropic said reports were generated by its top-level models, including Claude Mythos, to provide defenders with early defensive advantages.
• Nethermind and ZEUS were among the first applicants, and their requests covered a security review of the entire repository, as well as an assessment of wallet-related attack surfaces such as payments and private key processing.
• Anthropic plans to conduct case-by-case assessments based on factors such as infrastructure importance, user risk, remote attack exposure, and chain of dependence.
• This move reflects the industry's concern about ai驱动型网络攻击日益增长的担忧。多家加密公司已报告称，攻击者的行动速度已超过团队的补丁修复速度。

Anthropic 为开源社区引入自愿性漏洞报告机制

OSS Scanner 是 Anthropic 此前在“Project Glasswing”项目基础上延伸推出的服务。公司在公告中描述 OSS Scanner 为一种扫描开源代码并在分析后生成漏洞报告的服务。尽管 Anthropic 表示其已执行常规漏洞扫描并在人工审核后发送报告，但也承认了一个关键局限：人工审核流程缓慢，导致组织无法以维护者所需的速度分享安全问题。

OSS Scanner 的核心目标是提升速度和可用性。Anthropic 指出，该服务将基于其最强模型生成报告，并在存储库扫描完成后立即交付给参与项目。这种“扫描即报告”的工作流对于那些微小代码缺陷一旦被公开攻击者注意便可能产生重大影响的 projects 尤为关键。

据 Anthropic 介绍，加入该计划并非自动生效。公司声明该项目将根据个案进行评估，考量因素包括软件对基础设施和用户安全的重要性、遭受远程攻击的可能性，以及有多少用户或下游项目依赖于它。

加密项目通过 OSS Scanner 申请审计

The first batch of applications submitted to OSS Scanner demonstrated specific use cases in the encryption space. Pull requests submitted to Anthropic's OSS Scanner GitHub repository revealed that Nethermind has requested an audit of its entire repository. The request positions Ethereum client developers as part of critical infrastructure, where vulnerabilities could have disproportionately severe consequences for the entire ecosystem.

Self-managed Bitcoin and Lightning wallets ZEUS have also submitted review applications. The application focuses on weaknesses that could affect payments, private key processing and connections to Lightning services-areas that are particularly sensitive because of the involvement of user funds, secret material and network interactions.

Another cryptography-related applicant is VirtEngine, described as a decentralized cloud computing market structured as a Cosmos SDK chain. Other submissions in the initial batch came from developers building ai assistants , proxy security tools and machine learning infrastructure, as well as projects that provide software development tools, cloud storage and energy system control.

As of the time of publication of this article, none of the above pull requests have been merged, indicating that the registration review and acceptance process is still in progress and has not yet been fully finalized.

Why timing matters: Attackers are accelerating

The launch of the program comes at a time when cryptographic industry cybersecurity teams are forced to adapt to faster threats. Previous reports pointed out that acquiring cutting-edge aiTechnology is increasingly seen as a strategic advantage for defenders, and this uneven gain can widen the gap between attackers and teams trying to patch vulnerabilities in a timely manner.

Anthropic's warning at the time of release echoed this concern. The company said in a statement issued on Thursday that ai may favor attackers in the short term because exploiting vulnerabilities is cheaper and more efficient, while verifying and fixing vulnerabilities remain slow and labor-dependent.

This trend has been evident in many encryption incidents this year. According to previous reports, Bitcoin exchange provider Boltz suspended operations in August after encountering a wave of ai-assisted hacking attacks, in which the company said attackers were developing exploits faster than its team could patch them. In addition, cryptographic payment service PayPerQ has also reported multiple repeated attacks suspected to be driven by ai.

In this context, OSS Scanner's proposition-leveraging high-end models to automate vulnerability reporting and reduce bottlenecks for purely manual reviews-aims to shorten the time lag from "discovering problems" to "solving problems." For maintainers, this time difference determines whether the vulnerability remains private or becomes a publicly exploited security hazard.

Future Outlook for OSS Scanner adopters

While OSS Scanner provides a mechanism to generate security reports, for projects such as Nethermind and ZEUS, the actual impact depends on multiple dynamic factors: the speed at which scans are completed, the types of vulnerabilities that the model prioritizes, and the reliability with which maintainers translate findings into patch releases. Anthropic's case evaluation criteria also imply that the service may initially focus on the software with the highest risk relevance rather than providing uniform coverage for all applicants.

For readers and developers in the crypto space, the next metrics of observation are clear: whether approved projects receive timely reports; how these findings compare to what the team has previously detected through slower workflows; and whether faster vulnerability reporting will change the speed of mitigation of critical issues in open source infrastructure.

As attacks empowered by ai continue to evolve, OSS Scanner's early engagement in the encryption space will become an important test of whether model-assisted vulnerability reporting can help open source maintainers keep up with attackers-especially in systems where delays directly translate into real risks.