Anthropic 为开源项目推出免费的 AI 安全扫描服务

Anthropic 正通过一项名为 OSS Scanner 的新服务，帮助开源项目追踪安全漏洞。它表示，选择加入的开源项目将“免费获得由我们最强模型执行的全面、定期安全扫描”。这意味着开源项目可能更早收到潜在安全问题的提醒，但相应的取舍是，OSS Scanner 的报告不包含人工审核：

这项自愿加入的漏洞扫描器所输出的结果将完全由模型生成，不经过人工审核或分诊。这将支持更快、更频繁的扫描，但也意味着报告可能存在错误或无效的情况。这些报告将由我们最强大的模型（包括 Claude Mythos）生成，以便为开源项目带来最大的防御优势。

OSS Scanner 远非首个利用 AI 协助挖掘漏洞的工具。近几个月来，AI 工具已帮助发现开源软件中的一些重大安全缺陷，例如 5 月影响几乎所有 Linux 发行版的 “Copy Fail” 漏洞。与此同时，一些开源项目正难以应对突然涌入的 AI 生成漏洞报告，Linus Torvalds 和Google都在其中。

Anthropic’s offering to help open-source projects track down security vulnerabilities with a new service called OSS Scanner. It says open-source projects that opt-in will get “thorough, periodic security scans by our strongest models at no cost.” That could mean open-source projects get alerted about possible security issues sooner, but the trade-off is that OSS Scanner’s reports don’t come with human review:

The outputs of this opt-in vulnerability scanner will be fully model-generated, without human review or triage. This will enable faster and more frequent scanning, but means that it is possible reports will be incorrect or invalid. These reports will be generated by our strongest models (including Claude Mythos) to give open-source projects the largest defensive advantage.

OSS Scanner is far from the first AI bug hunting helper out there. AI tools have helped find some major security flaws in open-source software over recent months, like the “Copy Fail” bug that impacted nearly every Linux distro in May. At the same time, some open-source projects are struggling to keep up with the sudden onslaught of AI-generated bug reports, including Linus Torvalds and even Google.