Anthropic’s Nov. 2 dashboard counted 37,966 model-generated vulnerability candidates across the program, with 6,009 findings confirmed as valid after external review.
The dashboard recorded 6,376 externally reviewed candidates, of which 6,009 were confirmed valid, a 94.2% true-positive rate. On Aug. 26, it recorded 5,008 reviewed and 4,576 confirmed, or 91.4%. Anthropic defines the rate as the share of externally reviewed findings confirmed as valid. It includes duplicates and findings maintainers may choose not to fix, so it does not measure repairs.
Candidates are model-generated hypotheses awaiting triage; ledger entries track disclosures and their status. The figures describe different stages of Anthropic’s reporting process. The separate Nov. 2 ledger contained 7,349 entries, including 5,087 marked disclosed. Some entries show only a commitment hash until disclosure details become available.
The ledger marked 217 entries fixed and 419 withdrawn, compared with 202 fixed and 245 withdrawn in its Aug. 26 snapshot. The Nov. 2 ledger listed 1,654 duplicates; the earlier snapshot labeled two entries “merged,” so those categories are not directly comparable.
Anthropic’s Oct. 8 launch announcement described the volume of work behind the scanner. Over six months, the company’s models had generated more than 29,000 candidate vulnerabilities, while people had manually reviewed about 6,000. Anthropic said maintainers who requested bulk submissions had received nearly 5,000 unverified reports.
The company describes OSS Scanner as an opt-in service for eligible open-source projects, enrolled by their core maintainers. It sends model-generated reports before a person reviews or triages them, and Anthropic warns that some may be incorrect or invalid. Maintainers must assess which reports warrant attention, a challenge covered in EconoTimes’ earlier report on Anthropic’s scanner.