Anthropic sends unreviewed AI bug reports with proofs of concept to open source maintainers

Anthropic gives the 90% figure as an expectation and says it aims to raise it over time ^[7]. At that floor, up to about one report in ten would describe a flaw that is not there ^[17]. Anthropic's own list of inaccuracies to expect includes wrong severity ratings ^[8]. "The reports are model-generated and sent without human review," Anthropic said ^[3].

Taking out the reviewer is deliberate. Skipping review gets reports to maintainers faster, according to the company ^[8]. Anthropic says finding vulnerabilities has never been easier, while verifying, prioritizing and patching them is still hard ^[9]. Flaws found through its earlier Project Glasswing often took months to fix, and the company admitted Glasswing has not yet cut cyber risk enough ^[10]. OSS Scanner drops Anthropic's own verification step, one of the hard parts on that list. Projects that say they can keep up with the findings do that work themselves ^[5].

For operators, the effect shows up in their dependencies. Opt-in projects will hear about flaws sooner ^[8]. Whether fixes ship sooner depends on each maintainer's triage capacity. The only fix-time evidence Anthropic offered is the Glasswing record of months-long fixes ^[10]. The announcement as reported does not say how many projects have enrolled or how reports, proofs of concept included, reach maintainers.

Patch cycles in OT are longer still. Anthropic noted that OT systems often cannot be taken offline for patching, so known vulnerabilities can stay open for years. In rare cases, it said, a patch could take decades to apply safely ^[14]. Through the Critical Infrastructure Defense Program, the companies that handle OT security for power, water, manufacturing and transportation operators get access to Anthropic's frontier Claude models, its threat research and engineers working on site ^[12]. Several partners already use Claude to fix vulnerabilities and help customers do the same, according to Anthropic ^[16]. It is starting with a small group and plans to add partners and sectors in the coming months ^[15].