The new speed is receiver speed.
Anthropic opened OSS Scanner as an opt-in service for established open-source projects. Its fast track sends model-generated reports without human review. The stated goal is to get findings, reproducers, and proposed patches to maintainers sooner.[1]
That changes the bottleneck. The scanner can produce a report before an external researcher has reproduced it. The maintainer now owns the first project-specific verdict. Fast delivery helps only when the receiving project has a private route, an isolated test environment, and a named person who can say what the result means.
"Received" is transport state. "Reproduced" is test state. "Confirmed" is a project verdict.
Keep the raw report label attached.
The launch post says the reports are fully model-generated and may be incorrect. Anthropic also reports that 85 of 97 early critical or high findings met its coordinated-disclosure bar. Eleven of the remaining twelve were real but duplicate, and one was invalid.[2]
Those early results are useful program evidence. They do not confirm the next report in a maintainer's inbox. Keep the source label on each report until a project witness reproduces the behavior at a named revision. Preserve duplicate, out-of-scope, and severity-adjusted as real outcomes. Do not compress them into false positive.
Make the threat model executable enough to disagree.
The enrollment format accepts a project-specific threat model. It can name adversarial inputs, code in scope, severity rules, useful proof formats, patch expectations, and deduplication preferences. Without it, the scanner has to infer those boundaries.[1]
Write the disagreement rules before the report arrives. A parser bug in unreachable tooling is not the same as a pre-authenticated server path. A crash reproducer is not proof of code execution. A proposed patch is not ready because it silences one input.
REPORT_STATE=RECEIVED_UNVALIDATED
TARGET_REVISION=[REQUIRED]
ISOLATED_REPRO=[REQUIRED]
PROJECT_THREAT_MODEL=[REQUIRED]
REACHABLE_PATH=[UNKNOWN]
MAINTAINER_VERDICT=[PENDING]
RESPONSE_OWNER=[REQUIRED]The build boundary needs its own warning label.
The public repository says setup builds a project in an isolated virtual machine with network access, then scans it without Internet access. Its local tools/check helper runs a project's Dockerfile with network access. The repository warns that the build can reach services on the host and local network, even under its QEMU option.[3]
That means "offline scan" does not describe the whole path. Dependency fetch and image construction happen earlier. Maintainers should review the Dockerfile, pin inputs where practical, use a disposable host or isolated builder, and separate build-network reach from scan-network reach.
Do not borrow confidence from the human-reviewed lane.
Anthropic's disclosure dashboard keeps model candidates, external-firm review, maintainer acknowledgement, upstream patches, and assigned advisories as separate counts. It also says the reported true-positive rate includes duplicates and findings outside a project's intended threat model.[4]
Use the same separation inside the project. A raw report can justify private triage. A reproducer can justify technical investigation. A confirmed reachable path can justify severity and response. Public disclosure follows the project's coordinated process, not the scanner's initial wording.