Nethermind and ZEUS seek Anthropic AI bug reports that skip human review

Anthropic says it dropped the reviewer for speed. The company said manual review is slow, "so we're not always able to share vulnerabilities as quickly as we would like" ^[5]. About 23,000 candidate flaws are still waiting for review, roughly 79% of everything its models flagged ^[19][20]. OSS Scanner is the company's answer: reports go out as soon as a project's code is scanned ^[12].

Anthropic said the reports "will be generated by our strongest models (including Claude Mythos) to give open-source projects the largest defensive advantage" ^[3]. In early testing, 12 serious findings failed the penetration testers' check, a miss rate of about 12% ^[18]. If that rate held across the 23,000 unreviewed findings, roughly 2,800 reports would fail Anthropic's own bar ^[21].

If approved, the crypto teams could get real bugs plus suggested fixes ^[13], for free ^[2]. They could instead get a stack of findings that fall apart once someone checks them. Or the requests could sit. Anthropic decides case by case, weighing a project's importance to infrastructure and user security, its exposure to remote attacks and how many users or projects depend on it ^[8]. It has not set a timetable for approving the crypto applicants or delivering their first reports ^[9].

I think an OSS Scanner application tells an investor what a team wants and little about how safe its code is. The crypto.news report described the filings as requests for participation, not confirmation that the projects have completed security audits ^[11]. The counter-case is reasonable. An 88% pass rate on serious findings ^[15] is high for machine output that no person has checked. A report that arrives with a proposed patch should also cost a maintainer less to verify than the bug would cost to find. I am wrong if the first crypto reports hold up at close to that rate, because then enrollment alone would predict real fixes.

Anthropic itself named speed as the risk. It warned that AI may favor attackers in the near term, because exploitation is getting cheaper while verifying and fixing flaws stays slow and dependent on people ^[17]. Boltz, a Bitcoin swap provider, suspended operations in August, saying attackers were developing exploits faster than its team could patch them ^[10].