{"schemaVersion":"1.0","generatedFrom":"https://brightaifuture.com/discoveries/anthropic-oss-scanner-free-open-source-security","record":{"id":"anthropic-oss-scanner-free-open-source-security","headline":"Anthropic’s free OSS Scanner helped uncover a serious curl flaw. The fix is already out.","canonicalUrl":"https://brightaifuture.com/discoveries/anthropic-oss-scanner-free-open-source-security","datePublished":"2026-10-19","dateModified":"2026-10-19","sourcePublicationDate":"2026-10-19","author":null,"publisher":{"name":"Bright AI Future","url":"https://brightaifuture.com/"},"topics":[],"summary":"A maintainer-confirmed repair shows what AI-assisted security can deliver. Anthropic’s October 19 update also raises a bigger question: how do we give open-source defenders more capability without simply giving them more work?","evidenceState":"Deployed","keyFacts":[{"label":"AI’s role","value":"Anthropic’s opt-in OSS Scanner uses models to audit accepted projects and send unvalidated findings, proof-of-concepts and proposed patches where available."},{"label":"Documented result","value":"Curl confirms CVE-2026-92392 was fixed in curl 8.23.0 on October 14, crediting Luna Tong at Anthropic using OSS Scanner for discovery and Stefan Eissing for the patch. Anthropic’s October 19 update reports 77 critical and 803 high model-rated findings."},{"label":"Important limitation","value":"The 77 critical and 803 high findings are provider-reported and model-rated, not 880 independently confirmed or fixed vulnerabilities."}],"limitations":["The 77 critical and 803 high findings are provider-reported and model-rated, not 880 independently confirmed or fixed vulnerabilities.","Initial report delivery failures mean the totals do not establish confirmed receipt by every maintainer.","Reports have not undergone human review and can miss problems, misjudge severity or suggest patches that break functionality.","The curl vulnerability was rated high, not critical; successful exploitation requires particular conditions and a crash is more likely.","A released curl fix does not establish installation by every affected application. The September 15 report preceded the October 8 service launch.","This October 19 follow-up does not establish any OSS Scanner role in the OpenCode incident."],"evidenceLinks":[{"title":"Daniel Stenberg: A UAF turned RCE","url":"https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/","type":"institution"},{"title":"curl advisory CVE-2026-92392","url":"https://curl.se/docs/CVE-2026-92392.html","type":"institution"},{"title":"ClaudeDevs October 19 findings update","url":"https://x.com/ClaudeDevs/status/2112299603634860121","type":"institution"},{"title":"Punit Shah: initial delivery failures and encryption","url":"https://x.com/thepunit/status/2112269363835490450","type":"institution"},{"title":"Punit Shah: GitHub advisory delivery pilot","url":"https://x.com/thepunit/status/2112269584157798520","type":"institution"},{"title":"October 8 OSS Scanner launch","url":"https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source","type":"institution"},{"title":"OSS Scanner enrollment repository","url":"https://github.com/anthropics/oss-scanner","type":"institution"},{"title":"OSS Scanner eligibility and safeguards","url":"https://red.anthropic.com/oss-scanner/","type":"institution"},{"title":"OSS Scanner agreement","url":"https://red.anthropic.com/oss-scanner/terms/","type":"institution"},{"title":"curl project adoption list","url":"https://curl.se/docs/companies.html","type":"institution"},{"title":"ClaudeDevs October 19 opening announcement","url":"https://x.com/ClaudeDevs/status/2112299602510749992","type":"institution"},{"title":"Punit Shah October 19 enrollment and results thread","url":"https://x.com/thepunit/status/2112267286237384738","type":"institution"}],"evidencePackUrl":"https://brightaifuture.com/evidence-pack/anthropic-oss-scanner-free-open-source-security","embedUrl":"https://brightaifuture.com/embed/story/anthropic-oss-scanner-free-open-source-security","attribution":{"credit":"Bright AI Future","requirements":["Link to the canonical Bright record.","Keep material limitations with the claim they qualify.","Link to the original evidence when repeating a substantive claim.","Do not describe a source check or organization-reported result as independent verification."],"sourceRights":"Linked source material, quotations, trademarks and media remain subject to their owners’ terms. No reuse right is granted for third-party media."}},"claim":{"humanProblem":"Maintainers of widely shared open-source software need help finding and repairing serious security flaws without an unmanageable report queue.","priorConstraint":"Manual review and maintainer capacity can delay vulnerability assessment and remediation.","aiRole":"Anthropic’s opt-in OSS Scanner uses models to audit accepted projects and send unvalidated findings, proof-of-concepts and proposed patches where available.","documentedResult":"Curl confirms CVE-2026-92392 was fixed in curl 8.23.0 on October 14, crediting Luna Tong at Anthropic using OSS Scanner for discovery and Stefan Eissing for the patch. Anthropic’s October 19 update reports 77 critical and 803 high model-rated findings.","whyItMayMatter":"Bright’s view: defensive capacity should reach maintainers of shared software alongside usable evidence, control over the process and support for the human work of validating findings and releasing safe repairs.","unresolvedQuestions":["How will maintainers validate and remediate reported findings, and how effectively will improved delivery reduce the practical workload?"]},"evidenceAssessment":{"state":"Deployed","claimConfidence":"unassessed","reviewState":"approved","reviewMethod":"ai-assisted","reviewNote":"Owner-authorized reviewed follow-up. Official pages and curl advisory checked directly; October 19 social permalinks and full threads browser-verified. Sources checked 2026-10-19T22:18:00Z. Service launched October 8; curl fix October 14; October 19 is the results update. Model-rated findings remain distinct from independently confirmed fixes. Expanded on 2026-10-19T22:28:10.407Z with reviewed public-interest analysis, adoption context, selected provider quality sample, maintainer workload, enrollment controls and reader guidance. Original publication date and initial revision retained.","lastSourceReview":"2026-10-19","independentVerification":"not-established-by-this-source-review"},"sources":[{"id":"source:anthropic-oss-scanner-free-open-source-security:maintainer","title":"Daniel Stenberg: A UAF turned RCE","type":"institution","url":"https://daniel.haxx.se/blog/2026/10/14/a-uaf-turned-rce/"},{"id":"source:anthropic-oss-scanner-free-open-source-security:advisory","title":"curl advisory CVE-2026-92392","type":"institution","url":"https://curl.se/docs/CVE-2026-92392.html"},{"id":"source:anthropic-oss-scanner-free-open-source-security:results","title":"ClaudeDevs October 19 findings update","type":"institution","url":"https://x.com/ClaudeDevs/status/2112299603634860121"},{"id":"source:anthropic-oss-scanner-free-open-source-security:delivery","title":"Punit Shah: initial delivery failures and encryption","type":"institution","url":"https://x.com/thepunit/status/2112269363835490450"},{"id":"source:anthropic-oss-scanner-free-open-source-security:updates","title":"Punit Shah: GitHub advisory delivery pilot","type":"institution","url":"https://x.com/thepunit/status/2112269584157798520"},{"id":"source:anthropic-oss-scanner-free-open-source-security:launch","title":"October 8 OSS Scanner launch","type":"institution","url":"https://www.anthropic.com/research/launching-opt-in-vuln-finding-service-for-open-source"},{"id":"source:anthropic-oss-scanner-free-open-source-security:repository","title":"OSS Scanner enrollment repository","type":"institution","url":"https://github.com/anthropics/oss-scanner"},{"id":"source:anthropic-oss-scanner-free-open-source-security:docs","title":"OSS Scanner eligibility and safeguards","type":"institution","url":"https://red.anthropic.com/oss-scanner/"},{"id":"source:anthropic-oss-scanner-free-open-source-security:terms","title":"OSS Scanner agreement","type":"institution","url":"https://red.anthropic.com/oss-scanner/terms/"},{"id":"source:anthropic-oss-scanner-free-open-source-security:adoption","title":"curl project adoption list","type":"institution","url":"https://curl.se/docs/companies.html"},{"id":"source:anthropic-oss-scanner-free-open-source-security:opening","title":"ClaudeDevs October 19 opening announcement","type":"institution","url":"https://x.com/ClaudeDevs/status/2112299602510749992"},{"id":"source:anthropic-oss-scanner-free-open-source-security:sample","title":"Punit Shah October 19 enrollment and results thread","type":"institution","url":"https://x.com/thepunit/status/2112267286237384738"}],"revisions":[{"id":"anthropic-oss-scanner-free-open-source-security-initial","recordedAt":"2026-10-19T22:20:36.221Z","sourceIds":["source:anthropic-oss-scanner-free-open-source-security:maintainer","source:anthropic-oss-scanner-free-open-source-security:advisory","source:anthropic-oss-scanner-free-open-source-security:results","source:anthropic-oss-scanner-free-open-source-security:delivery","source:anthropic-oss-scanner-free-open-source-security:updates","source:anthropic-oss-scanner-free-open-source-security:launch","source:anthropic-oss-scanner-free-open-source-security:repository","source:anthropic-oss-scanner-free-open-source-security:docs","source:anthropic-oss-scanner-free-open-source-security:terms"],"summary":"Initial reviewed follow-up: maintainer-confirmed curl repair and October 19 scanner results, with delivery and validation limits."},{"id":"anthropic-oss-scanner-free-open-source-security-expansion-2026-10-19T22:28:10.407Z","recordedAt":"2026-10-19T22:28:10.407Z","sourceIds":["source:anthropic-oss-scanner-free-open-source-security:maintainer","source:anthropic-oss-scanner-free-open-source-security:advisory","source:anthropic-oss-scanner-free-open-source-security:results","source:anthropic-oss-scanner-free-open-source-security:delivery","source:anthropic-oss-scanner-free-open-source-security:updates","source:anthropic-oss-scanner-free-open-source-security:launch","source:anthropic-oss-scanner-free-open-source-security:repository","source:anthropic-oss-scanner-free-open-source-security:docs","source:anthropic-oss-scanner-free-open-source-security:terms","source:anthropic-oss-scanner-free-open-source-security:adoption","source:anthropic-oss-scanner-free-open-source-security:opening","source:anthropic-oss-scanner-free-open-source-security:sample"],"summary":"October 19 expansion: added Bright commentary on public-interest maintenance and defensive access, curl adoption and chronology, provider sample limitations, delivery and maintainer-workload trade-offs, enrollment safeguards and practical reader guidance. Original publication retained."}],"corrections":[]}