[REVISION HISTORY]

Anthropic AI-driven open-source security initiatives

6 recorded revisions of this situation.

What changed

2026-11-02 05:08 UTC → 2026-11-03 20:58 UTC · added ~~removed~~

Anthropic has introduced several AI-driven tools aimed at enhancing cybersecurity for open-source software. The company initially launched the OSS Scanner, a free service that uses frontier models like Claude Mythos to provide automated, periodic scans of codebases to identify potential vulnerabilities. This initiative specifically targets small teams and critical operational technology, such as transportation and electrical grids. Following this, Anthropic released research findings from a study where Claude analyzed over 5 million lines of code across 25 projects, uncovering 493 potential security issues. Notable discoveries included a 21-year-old vulnerability and the identification of experimental code in OpenSSH that remained accessible to unauthenticated clients. To expand these capabilities, Anthropic is piloting ‘Claude Security’ in public beta for Enterprise users. This tool offers continuous repository scanning, tracks remediation, and suggests patches for human review, functioning as an additional layer of security within developer workflows. Beyond open-source scanning, Anthropic’s Frontier Red Team has demonstrated advanced autonomous capabilities. An unreleased research model, according to a report published on October 27, 2026, has shown the ability to autonomously develop functional exploit chains for major platforms, including Chrome, Safari, Android, Windows, and Linux. In specific demonstrations, the model used a sequence of flaws in Chrome to escape the browser sandbox and execute code, and bypassed the same-origin policy in Safari. On mobile, it identified a chain to extract personal data from a locked Google Pixel 9 via USB. In server environments, it discovered a zero-click vulnerability in the Linux kernel (CVE-2026-98432) that allowed it to gain root privileges within approximately 53 minutes. Anthropic reported all findings to the respective vendors; Google, Apple, and Microsoft have since patched the identified vulnerabilities. On ~~October 31,~~ November 2, 2026, ~~new~~ reports ~~highlighted further security concerns.~~ emerged regarding a supply chain attack involving a trojanized version of the Anthropic Claude Code extension (versions 2.1.312 and 2.1.313).

Versions

Select a version to see what changed compared to the one before it.