Anthropic’s free OSS Scanner helped uncover a serious curl flaw. The fix is already out.

Dates and assessment

Source published

2026-10-19

Bright published

2026-10-19

Substantive update

2026-10-19

Evidence state

Deployed

Independent verification

Not established by this source review

Last source review

2026-10-19

The claim in context

The human problem

Maintainers of widely shared open-source software need help finding and repairing serious security flaws without an unmanageable report queue.

The prior constraint

Manual review and maintainer capacity can delay vulnerability assessment and remediation.

AI’s actual role

Anthropic’s opt-in OSS Scanner uses models to audit accepted projects and send unvalidated findings, proof-of-concepts and proposed patches where available.

The documented result

Curl confirms CVE-2026-92392 was fixed in curl 8.23.0 on October 14, crediting Luna Tong at Anthropic using OSS Scanner for discovery and Stefan Eissing for the patch. Anthropic’s October 19 update reports 77 critical and 803 high model-rated findings.

Why it may matter

Bright’s view: defensive capacity should reach maintainers of shared software alongside usable evidence, control over the process and support for the human work of validating findings and releasing safe repairs.

Limitations

• The 77 critical and 803 high findings are provider-reported and model-rated, not 880 independently confirmed or fixed vulnerabilities.
• Initial report delivery failures mean the totals do not establish confirmed receipt by every maintainer.
• Reports have not undergone human review and can miss problems, misjudge severity or suggest patches that break functionality.
• The curl vulnerability was rated high, not critical; successful exploitation requires particular conditions and a crash is more likely.
• A released curl fix does not establish installation by every affected application. The September 15 report preceded the October 8 service launch.
• This October 19 follow-up does not establish any OSS Scanner role in the OpenCode incident.

Original evidence

• Daniel Stenberg: A UAF turned RCE · institution
• curl advisory CVE-2026-92392 · institution
• ClaudeDevs October 19 findings update · institution
• Punit Shah: initial delivery failures and encryption · institution
• Punit Shah: GitHub advisory delivery pilot · institution
• October 8 OSS Scanner launch · institution
• OSS Scanner enrollment repository · institution
• OSS Scanner eligibility and safeguards · institution
• OSS Scanner agreement · institution
• curl project adoption list · institution
• ClaudeDevs October 19 opening announcement · institution
• Punit Shah October 19 enrollment and results thread · institution

Attribution

Credit Bright AI Future and link the canonical Bright record.

• Link to the canonical Bright record.
• Keep material limitations with the claim they qualify.
• Link to the original evidence when repeating a substantive claim.
• Do not describe a source check or organization-reported result as independent verification.

Linked source material, quotations, trademarks and media remain subject to their owners’ terms. No reuse right is granted for third-party media.