Anthropic says OSS Scanner found 880 high-risk vulnerabilities in 11 days, including critical curl flaw

US-based artificial intelligence company Anthropic disclosed on October 20, 2026, that its open-source software (OSS) security scanning service, "OSS Scanner," automatically judged 77 "urgent" and 803 "important" vulnerabilities using models like Claude Mythos within 11 days of its launch. These figures represent initial AI determinations and have not all been confirmed by human reviewers.

A key feature of the service is bypassing the manual verification step typical of traditional coordinated disclosure (CVD), sending reports directly to project maintainers with reproduction code, root cause analysis, and patch suggestions. Anthropic acknowledges that these unverified reports may contain false positives. According to internal early testing data, of 97 high-severity judgments across 48 projects, penetration testers validated 85 (approximately 88%) as meeting disclosure standards, with only one false positive. However, maintainers noted that the model tends to overestimate vulnerability severity or misunderstand project threat models.

A notable result was the discovery of CVE-2026-92392 in the communication library curl. This is a "use-after-free" defect during HTTP/2 uploads that could potentially lead to remote code execution. Daniel Stenberg, who leads curl development, evaluated it as one of the most severe vulnerabilities in recent years. Although attack conditions are strict and crashes are the most likely outcome, this finding prompted curl to release version 8.23.0 two weeks ahead of schedule.