Confirmed Claude-found open source bugs outnumber upstream patches 11 to 1

OSS Scanner, which Anthropic launched last week under its Cyber Mission ^[2], adds a second route for Claude's findings. In the existing disclosure program, six external security research firms reproduce and triage each candidate before it goes upstream ^[4]. On the new optional fast track, eligible projects get free periodic scans from Anthropic's top models, including Claude Mythos. That output goes to maintainers with no validation step at Anthropic ^[8]. The GitHub repository holds the enrollment and configuration tools but not the scanner itself ^[22], so the open source part of OSS Scanner is its sign-up tooling. Each project is built in an isolated VM with internet access cut before scanning begins, and maintainers can pause or opt out at any time ^[21].

In six months the disclosure route has reviewed about a fifth of Claude's candidates ^[26]. It rejects few of them: the firms confirmed 92.7% of the findings they checked ^[24]. The bigger drop comes after confirmation. Upstream projects have patched 9.1% of the confirmed bugs, about one patch for every 11 confirmed findings ^[27][29].

Apply that confirmation rate to the unreviewed remainder and you get about 21,000 more real bugs ^[25]. That estimate holds only if the firms checked a representative slice of the queue.

The fast track's precision rests on a smaller test. Expert penetration testers checked 97 critical and high-severity findings from an early scanner version across 48 projects ^[10]. Eighty-five cleared the disclosure bar, 11 of the other 12 were real bugs that duplicated known issues, and one was a false positive ^[10]. That puts real bugs at 99% and disclosure-grade findings at 88% ^[28]. The New Stack notes that the sample covers early output only. It excludes the 29,000 disclosure-program candidates and says little about lower-severity findings or behavior at scale ^[11]. For the rate to carry over, today's fast-track scans would need the early version's severity mix and accuracy. Anthropic's own technical announcement concedes that maintainers have flagged severity ratings set too high, along with cases where the scanner got a project's threat model wrong ^[12].

The reports themselves are well engineered. Anthropic says each one includes a self-contained reproducer and, when possible, a bisection showing where the bug was introduced. When the model can write a fix, a candidate patch comes with it ^[13]. OpenSSL Corporation director Anton Arapov said the reports, raw model output included, matched and sometimes beat what OpenSSL gets from human researchers ^[14]. He said a report with a working exploit attached is "basically job done for an engineer as you can verify it right away" ^[15]. PostgreSQL committer Noah Misch said several reports arrived with fixes the project could use "nearly as-is" ^[17]. He said fast-track access let PostgreSQL deal with the newest issues before any of them reached a GA release ^[18].

Those reports cut verification time. Testing the fix, backporting it and shipping it are still the maintainers' job, and sometimes the change will break behavior users depend on ^[23]. OpenSSH's maintainers made that call when they deliberately broke two features for security ^[23].

We think the evidence supports a patch backlog at the upstream end. It does not show the scanner making projects slower to fix anything: Misch describes fixes landing before a release ^[18]. The dashboard figures are a single reading dated October 2 ^[1], so any trend in the 516 patch count ^[5] will only appear in later readings.