Bright key facts / Deployed
Anthropic’s free OSS Scanner helped uncover a serious curl flaw. The fix is already out.
A maintainer-confirmed repair shows what AI-assisted security can deliver. Anthropic’s October 19 update also raises a bigger question: how do we give open-source defenders more capability without simply giving them more work?
- AI’s role
- Anthropic’s opt-in OSS Scanner uses models to audit accepted projects and send unvalidated findings, proof-of-concepts and proposed patches where available.
- Documented result
- Curl confirms CVE-2026-92392 was fixed in curl 8.23.0 on October 14, crediting Luna Tong at Anthropic using OSS Scanner for discovery and Stefan Eissing for the patch. Anthropic’s October 19 update reports 77 critical and 803 high model-rated findings.
- Important limitation
- The 77 critical and 803 high findings are provider-reported and model-rated, not 880 independently confirmed or fixed vulnerabilities.