Anthropic launches free AI scanner to protect open-source code

A free scanner for open-source code

Anthropic has launched a free AI scanner designed to help open-source projects find and fix security problems faster. The tool checks code regularly, flags vulnerabilities automatically, explains what is wrong, and suggests patches that maintainers can apply.

Nearly all modern software depends on open-source code, and most of it is maintained by small teams of volunteers who do not always have the time or resources to test every line for flaws. Anthropic said the scanner is meant to close that gap ¹.

The company expects the scanner to be more than 90 percent accurate, but it also warned that reports are sent out without human review and could still contain errors. Maintainers of projects that are important to infrastructure or user safety can choose to turn the scanner on through GitHub.

Why this matters now

Anthropic's bigger reason for building the tool is simple: attackers already have powerful AI models, but defenders have not had the same level of support. The company argued that giving open-source maintainers access to AI-powered security scanning levels the playing field.

The scanner is part of a larger Anthropic effort called Cyber Mission, announced alongside a Critical Infrastructure Defense Program. That program gives operators of power grids, water systems, and transportation networks access to Claude models, Anthropic engineers, and threat analysis. Founding partners include CrowdStrike, Palo Alto Networks, Deloitte, and Rockwell Automation ¹.

Related: workflows for multi-agent testing

On the same day, Anthropic also put dynamic workflows for Claude Managed Agents into public beta. In a workflow, one lead agent writes a plan that runs across many sub-agents in phases and then combines their results. A single run can start up to 1,000 agents, with up to 64 working at the same time ².

Anthropic tested the feature on its own bug-finding work. When 70 bugs were planted in a 116,000-line codebase, a single agent found 14, then 15, then 27 bugs across three separate runs. A workflow, however, found 66 bugs in each of its three runs ².

Workflows cost the same as regular agent runs: token rates for whichever model is used plus $0.08 per session-hour for managed agent runtime. A session budget can be set to cap spending.

What comes next

Both announcements point in the same direction. Anthropic is expanding the ways organizations and individual maintainers can use Claude to handle large, repetitive tasks — whether that is scanning open-source code for security flaws or running thousands of agents to find bugs in software. The company is betting that giving defenders better tools will matter as AI-powered attacks become more common.

The OSS scanner is now available for opt-in through GitHub, and the dynamic workflow feature is in public beta ².

Key facts

• The scanner runs automatically, flags vulnerabilities, and suggests patches with over 90 percent expected accuracy.
• Reports are generated without human review and may still contain errors.
• Maintainers of critical projects can opt in through GitHub.
• Dynamic workflows let one agent orchestrate up to 1,000 sub-agents across multiple phases.
• In Anthropic's test, a workflow found 66 bugs per run compared to 14-27 found by a single agent.

Seen on social

Claude Managed Agents dynamic workflows are now available in public beta. It's a new type of multiagent orchestration, built for your most ambitious workloads. A lead agent writes a plan that runs across many agents in phases, combining the results at the end. pic.twitter.com/hEExShsVku

— ClaudeDevs on X, see the post

Sources

1. Anthropic launches a free AI scanner for open-source projects — the-decoder.com
2. Claude Dynamic Workflows: 1,000 Agents per Run | CellCog — cellcog.ai