AI vulnerability scanning meets the maintainer bottleneck

What happenedAnthropic announced an opt-in service offering eligible open-source projects recurring vulnerability scans. Reports are model-generated and can include a reproducer and candidate patch. Its selected early validation sample included 97 high- or critical-rated findings: 85 met its disclosure bar, 11 duplicated known findings, and one was invalid.

Engineering perspective · analysisFor engineering teams, the useful unit is a validated fix, not a finding. Budget for reproduction, deduplication, threat-model review, patch tests, and maintainer time before increasing scan volume.

Limits of the evidenceThese are provider-reported results from a selected sample, not a general false-positive rate. Anthropic notes inflated severity and misunderstood threat models. Candidate fixes still need validation.