Anthropicが発表した「OSS Scanner」
AIがソフトウェアの脆弱性を探し、
問題の説明や修正案まで提示する仕組みです。
20年以上、Webシステムの開発に携わってきて、
その中で感じてきたのは、
「動くこと」と「安心して使い続けられること」は、同じではないということ。
システムは、完成して終わりではありません。
見えない問題を見つけ、
必要なところを直し、
大切な情報や利用する人を守り続ける。
AIに「つくる手」を渡すだけでなく、
「守る手」も渡していく。
そして、何を守り、どこまで任せるのかを決める。
私は、そこまで含めて
「AI右腕」の設計なのだと思います。
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
This is cool!
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
🔐 تملك مشروعا مفتوح المصدر؟
Anthropic ستبحث عن ثغراته بأقوى نماذجها مجانا
الخدمة اسمها OSS Scanner وتفحص المشاريع المشتركة فيها بشكل دوري
📦 ماذا تحصل عليه في كل تقرير؟
▫️ طريقة عملية لإعادة إنتاج الثغرة
▫️ شرح مبسط لها ومتى ظهرت في الكود إن أمكن
▫️ واقتراح إصلاح جاهز عند توفره
🛠️ كيف تشترك؟
▫️ الاشتراك للمشرفين الأساسيين على المشروع فقط
▫️ ترسل طلب دمج إلى مستودع الخدمة على GitHub وفق القالب المحدد
▫️ والقبول حسب أهمية المشروع للبنية التحتية وأمان المستخدمين
✅ وفي تجربة مبكرة راجع خبراء 97 ثغرة خطيرة فوجدوا واحدة فقط غير صحيحة
⚠️ التقارير يولدها النموذج دون مراجعة بشرية لذلك راجعها قبل الاعتماد عليها
المهاجمون يبحثون عن ثغراتك كل يوم
فلماذا لا تسبقهم إليها؟
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
We enrolled simplex-chat and simplexmq repos to Anthropic OSS Scanner. 👇
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
It seems as though artificial intelligence is gradually becoming more prevalent each day, but I wonder if there might be significant problems that are not detectable by AI and therefore require human intervention.
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Anthropic's models found so many security bugs that humans could only review about 1 in 5.
29,000 candidates in six months. ~6,000 triaged.
Now they're sending reports straight to maintainers who opt in, free, with no human triage. It's called OSS Scanner.
Sounds like a spam cannon. Except wolfSSL got 74 earlier ones and 72 were real.
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
オープンソースを公開している人は、Anthropicの無料の脆弱性スキャンに申し込めるようになりました。
Anthropicが10月8日、「OSS Scanner」を始めました。
分かっていること。
・申し込んだオープンソースのプロジェクトを、Claude Mythosを含む最上位のモデルで定期的にスキャンする。費用はかからない
・報告には、再現手順、脆弱性の説明、修正案が付く
・報告はモデルが作ったまま届き、人の確認や仕分けは通らない。そのぶん速く、頻繁に届くが、誤りの可能性もある
・Anthropicはこの半年で候補を2万9000件見つけたが、人が確認できたのは約6000件にとどまっている
・試験運用では、wolfSSLが「74件中72件が有効で、5件がCVEになった」と話している
申し込みまでの流れ。
① 公開しているプロジェクトのセキュリティ連絡先を決めておく
② Anthropicの発表ページからOSS Scannerに申し込む
③ 届いた報告は、まず再現手順で本当に起きるかを確かめる
条件を1つ。人の確認を通らない報告なので、そのまま修正を入れず、必ず自分で再現してから直してください。
今日やることを1つ。自分のリポジトリに、脆弱性の連絡先（SECURITY.md）があるか確かめてください。
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Anthropic: Para proteger el software de código abierto, estamos lanzando OSS Scanner.
Usaremos nuestros modelos de vanguardia para escanear periódicamente vulnerabilidades en proyectos de código abierto, sin costo alguno. Nuestros informes proporcionarán una prueba de concepto, explicación y corrección sugerida.
👇🏽
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
This is how you tackle security concerns. Not with doomsday prophecies. But with actual solutions. Nice
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
nice to see frontier labs offer this type of service... fuzzing on steroids... I do hope lessons from OSS-Fuzz are taken in account of overwhelming maintainers / false positives/dupes
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Great to see this
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
All the glasswing reports I received were so sloppy that I simply stopped replying to them. I wasn’t very impressed.
Problem is that it’s a slop cannon. Very little curation. Many duplicate findings. If they don’t put in time to give me high quality reports I ignore.
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
🚀🚀
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Pues se vienen más avances en ciberseguridad por parte de Anthropic
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Nice! 👏👏👏
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Nouveau coup dur pour le pentesting à venir 😬
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Ah, this sounds familiar🫡
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
The data collection is real 😂😂😂
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…
Great idea
To secure open-source software, we’re launching OSS Scanner.
We’ll use our frontier models to periodically scan opted-in open-source projects for vulnerabilities, at no cost. Our reports will provide a proof-of-concept, explanation, and suggested fix.
anthropic.com/research/launc…