Build1 publisher2 min readPublished
Apache Software Foundation scans 230 repositories with Claude Mythos in three days
Apache Software Foundation teams scanned 230 repositories with Anthropic's Claude Mythos 5 over three days in August 2026. Findings now go to the projects that own the code through the foundation's official disclosure path, and remediation has started.
The Engineer · Build desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- The effort began after Mythos scans that Alpha-Omega ran on two ASF projects came back specific and detailed enough that ASF Security judged them worth acting on.
- The sweep used an audit pipeline ASF Tooling has run since early 2026 on its Gofannon agent platform, checking code against the OWASP Application Security Verification Standard.
- Tooling first built the pipeline to audit its own release platform, Apache Trusted Releases, then widened it into a managed scanning service for any ASF project.
- A project chooses what it wants scanned, and the run proceeds unsupervised, started from a browser or through an API.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- decision A project that wants usable findings has to spend maintainer time on written guidance before the scan, so triage effort moves ahead of the report instead of following it.
- exposure Guidance can include private deployment details, and neither published ensemble self-hosts the heavy tier, so projects are choosing what they disclose to a hosted model.
- precedent Other foundations dealing with the same stream of drive-by AI reports now have a worked example of running scans centrally and routing results through their existing disclosure channels.
The design starts from a limit on people. According to the ASF teams, AI-generated vulnerability reports are reaching open source projects in growing volume, and many of them are not helpful [7]. Sorting the useful ones from the rest costs maintainer attention that projects often do not have to spare [7]. The teams wrote that the Foundation "should be the one running it with the projects, in terms of the projects set, and with enough context that the output is worth reading" [8]. ASF Tooling had run into a second limit from the other direction. Scanning projects on demand does not scale past a handful of them [9].
The pipeline's tier split is good engineering. A light tier does high-volume filtering, a medium tier builds inventories of what the code contains, and only the heavy tier does the analysis the teams say needs real reasoning [12]. One published ensemble is Opus, Sonnet and Haiku. The other puts Mythos on the heavy tier and self-hosted Gemma and Qwen models on the two lighter tiers [13]. According to the post, switching ensembles does not touch the pipeline itself [13]. Model choice is a runtime setting, so cost and vendor are decisions the operator can revisit without a rewrite [12].
The input I would copy first is the audit guidance. During development, Tooling found the models needed context about the codebase under review: its security posture, architectural decisions, team code standards and even private deployment choices [15]. The teams wrote that these inputs "drastically reduced false positives" and kept completely wrong inferences from surviving into a final report [15]. The post does not give false-positive rates, finding counts or severity figures for the 230-repository run.
The sweep averaged about 77 repositories a day [1]. That rate belongs to ASF's setup. For it to carry over, another organisation would need a heavy-tier model of similar quality, a way to pay for it, and projects that had written their guidance before the run started. ASF had the model and the funding. Mythos came through Anthropic's Project Glasswing security program [2], and a recent donation by Anthropic made the work possible [4].
Scale and routing are now shown [1] [3]. Accuracy at that scale is still the teams' own qualitative account. They describe the post as a report on work in progress [4]. The only outside results they cite are the Alpha-Omega scans that came before the sweep [5].
What to watch
- Whether ASF publishes counts of confirmed vulnerabilities, false positives or advisories from the 230-repository run.
- Which ensemble the managed scanning service uses by default once donated Mythos access is not paying for the heavy tier.