Anthropic has launched OSS Scanner, an opt-in vulnerability scanning service designed to help open-source projects identify and remediate security flaws before attackers take advantage. The program went live on Thursday, and the first wave of enrollment requests—submitted Friday—includes crypto-focused teams such as the Nethermind Ethereum client and ZEUS, a self-custodial Bitcoin and Lightning wallet.

For developers, the key promise is speed and scale: Anthropic said vulnerability reports will be generated using its strongest models (including Claude Mythos), with the goal of giving open-source communities a defensive edge. That matters as cybersecurity researchers and security teams warn that the attacker advantage could widen if threat actors gain quicker access to high-capability AI tools than defenders do.

Key takeaways

Anthropic’s OSS Scanner is an opt-in service that delivers vulnerability reports for open-source projects after code scanning.
Early crypto applicants include Nethermind (Ethereum client) and ZEUS (self-custodial Bitcoin/Lightning wallet), both aiming to audit security risks across sensitive components.
Reports are generated by top Anthropic models, including Claude Mythos, to improve the pace of vulnerability discovery and disclosure.
Anthropic reviews requests case-by-case, factoring in infrastructure importance, exposure to remote attacks, and dependency on the affected software.
None of the initial GitHub pull requests were merged at the time of publication, indicating onboarding is still underway.

What OSS Scanner is meant to change for open-source security

OSS Scanner is Anthropic’s new, opt-in vulnerability-finding service for open-source projects. Anthropic says the initiative builds on its earlier work on Project Glasswing, where it already scanned open-source code regularly and shared reports after human review.

The company’s stated problem with that earlier approach is not the quality of scanning, but the bottleneck: manual review can be slow, meaning issues are not always communicated as quickly as maintainers and users would prefer. OSS Scanner is intended to reduce that delay by generating vulnerability reports automatically using its strongest models, while still operating as an opt-in program for enrolled projects.

Anthropic’s announcement frames the service as a defensive tool. According to the company, OSS Scanner will deliver reports as soon as a participating project’s code has been scanned, shifting the workflow toward faster turnaround for open-source maintainers.

Why this is drawing attention in crypto circles

Crypto infrastructure has become an especially high-value target, and the industry has increasingly pointed to AI-enabled tactics as a reason vulnerabilities may be discovered—or exploited—at greater speed than teams can patch.

Earlier coverage from Cointelegraph highlighted how “few crypto firms have access to frontier AI as cyber threats escalate,” underscoring the broader imbalance between attacker capability and defender readiness. Anthropic’s rollout lands in that context, with the company warning that powerful AI can reduce the cost of exploitation while making verification and remediation slower because those steps depend on people.

Anthropic also cited its own broader cyber mission warning, noting that AI may favor attackers in the near term. That risk profile is particularly relevant to projects where a single flaw can affect funds directly, such as wallets, payment systems, or core network components.

Nethermind and ZEUS are among the first to request audits

According to pull requests posted in OSS Scanner’s GitHub repository, multiple projects submitted enrollment requests on Friday. Among the most notable crypto applicants are:

Nethermind, an Ethereum client developer, submitted a request for audits covering its entire repository (as shown in its GitHub pull request https://github.com/anthropics/oss-scanner/pull/38).
ZEUS, a self-custodial Bitcoin and Lightning wallet, requested examination of its application for weaknesses that could affect payments, private keys, and integration with Lightning services (GitHub pull request https://github.com/anthropics/oss-scanner/pull/47).
VirtEngine, described as a decentralized cloud computing marketplace built around a Cosmos SDK chain, also submitted an application (GitHub pull request https://github.com/anthropics/oss-scanner/pull/46).

Anthropic said it will evaluate projects on a case-by-case basis. The company’s stated criteria include how important the software is to infrastructure and user security, its exposure to remote attacks, and how many users or other projects rely on it.

At the time this information was published, none of these pull requests had been merged—so it’s best to view the enrollment activity as a stage in the onboarding process rather than a guarantee that every requested audit will proceed immediately or that results have already been delivered.

Broader applicant pool and what to watch next

Beyond crypto, Anthropic’s initial request pool includes a mix of open-source developers building AI assistants, agent-security tools, and machine-learning infrastructure, along with teams working on development tooling, cloud storage, and energy-system controls. That breadth signals Anthropic’s intention to position OSS Scanner as a general-purpose “defensive advantage” program rather than a niche offering limited to any single sector.

Still, for crypto users and developers, the immediate question is what happens after enrollment: how quickly reports arrive, how actionable they are for maintainers, and whether the service changes patch timelines for high-risk components like wallets, payment tooling, and core client software.

Readers should watch for merged onboarding requests and any subsequent vulnerability report disclosures from participating teams—especially where software touches funds, keys, or remote network exposure. As AI-assisted attack narratives continue to circulate across the sector, faster vulnerability identification may become a competitive necessity, not a technical luxury.