[CLSTR]
API
< Back to situations

Monitor this situation.

[SITUATION] · [ACTIVE] · [TECHNOLOGY]

5 clusters · 29 sources · 24 days · First seen · Last updated

Anthropic AI-driven open-source security initiatives

Overview

Anthropic has introduced several AI-driven tools aimed at enhancing cybersecurity for open-source software. The company initially launched the OSS Scanner, a free service that uses frontier models like Claude Mythos to provide automated, periodic scans of codebases to identify potential vulnerabilities. This initiative specifically targets small teams and critical operational technology, such as transportation and electrical grids. Following this, Anthropic released research findings from a study where Claude analyzed over 5 million lines of code across 25 projects, uncovering 493 potential security issues. Notable discoveries included a 21-year-old vulnerability and the identification of experimental code in OpenSSH that remained accessible to unauthenticated clients. To expand these capabilities, Anthropic is piloting ‘Claude Security’ in public beta for Enterprise users. This tool offers continuous repository scanning, tracks remediation, and suggests patches for human review, functioning as an additional layer of security within developer workflows. Beyond open-source scanning, Anthropic’s Frontier Red Team has demonstrated advanced autonomous capabilities. An unreleased research model, according to a report published on October 27, 2026, has shown the ability to autonomously develop functional exploit chains for major platforms, including Chrome, Safari, Android, Windows, and Linux. In specific demonstrations, the model used a sequence of flaws in Chrome to escape the browser sandbox and execute code, and bypassed the same-origin policy in Safari. On mobile, it identified a chain to extract personal data from a locked Google Pixel 9 via USB. In server environments, it discovered a zero-click vulnerability in the Linux kernel (CVE-2026-98432) that allowed it to gain root privileges within approximately 53 minutes. Anthropic reported all findings to the respective vendors; Google, Apple, and Microsoft have since patched the identified vulnerabilities. On November 2, 2026, reports emerged regarding a supply chain attack involving a trojanized version of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313).

Entities

Anthropic · Claude · Google · Open VSX · Linux

Claims

What the coverage asserts, and how many sources carry each claim.

Timeline

  1. [TECHNOLOGY] 5 sources
    Anthropic Claude Code extension compromised via Cursor Marketplace

    Malicious versions of the Anthropic Claude Code extension were distributed via the Cursor Marketplace, creating persistent SSH backdoors on macOS and Linux systems for up to 5,000 developers.

  2. [TECHNOLOGY] 7 sources
    Anthropic researchers discover critical Linux kernel vulnerability

    Anthropic researchers discovered a critical 9.8-rated Linux kernel vulnerability that Claude AI helped exploit in 53 minutes. Separately, a compromised Claude Code extension put 5,000 developers at risk.

  3. [TECHNOLOGY] 9 sources
    Anthropic research model develops functional exploits for major operating systems

    An unreleased Anthropic Claude model successfully developed functional exploit chains for Chrome, Safari, Android, Windows, and Linux in laboratory tests, targeting critical system vulnerabilities.

  4. [TECHNOLOGY] 5 sources
    Anthropic uses Claude AI to identify security vulnerabilities in open source projects

    Anthropic’s Claude AI identified 493 security issues across 25 open-source projects, including a 21-year-old flaw in OpenSSH, while launching a new continuous repository scanning tool for enterprises.

  5. [TECHNOLOGY] 5 sources
    Anthropic launches free AI-driven security scanner for open-source code

    Anthropic has introduced the free OSS Scanner, using advanced AI models to provide automated security vulnerability audits for open-source software projects.

Sources

android-mt.ouest-france.fr · begeek.fr · bitnewsbot.com · blog-nouvelles-technologies.fr · compsmag.com · cybernoz.com · developpez.net · diarioti.com · dijitaliyidir.com · emarketerz.fr · enterprisesecuritytech.com · flagthis.com · generation-nt.com · infoguerra.com.br · infoq.com · innovation-village.com · it-connect.fr · ithome.com · itnews.com.au · jornal24horas.com.br · linformatique.org · linuxsecurity.com · minutodaseguranca.blog.br · shiftdelete.net · technaujienos.lt · techtarget.itmedia.co.jp · the-decoder.com · tokenpost.com · tuttoperinternet.it

This summary has been updated 6 times: see revision history