AI Now Hunts Bugs in the Code Your Website Runs On

Anthropic just pointed its strongest models at open-source code and handed the results to maintainers for free. If your business runs on WordPress, that code is your code. The practical effect is not that your site suddenly got safer — it is that the clock between a bug becoming public and your site getting patched just got shorter.

“Anthropic’s offering to help open-source projects track down security vulnerabilities with a new service called OSS Scanner. It says open-source projects that opt-in will get ‘thorough, periodic security scans by our strongest models at no cost.’ That could mean open-source projects get alerted about possible security issues sooner, but the trade-off is that OSS Scanner’s reports don’t come with human review.”

Stevie Bonifield, The Verge

Our take

Start with what the service actually is. Per Anthropic’s own announcement, OSS Scanner is opt-in, free, and modeled on Google’s OSS-Fuzz. Enrolled projects get periodic scans from Anthropic’s strongest models, and each report arrives with a proof of concept showing how the bug could be exploited, an explanation, and a suggested fix where one exists. Maintainers enroll at red.anthropic.com/oss-scanner. Anthropic states plainly that the outputs are fully model-generated without human review or triage, that it expects a true-positive rate above 90%, and that projects without the capacity to absorb that volume will keep getting human-verified disclosures under its coordinated vulnerability disclosure policy. The same announcement lists free Claude Max subscriptions for maintainers and a fund that keeps the scanner free.

Now the part nobody says out loud. Finding bugs and fixing bugs are not the same job, and they do not scale at the same rate. A frontier model can scan a codebase on a schedule. A volunteer maintainer with a day job patches when they can. Pour machine-speed discovery into human-speed remediation and you do not get a safer internet in the short run — you get a longer list of known, published, unpatched problems. That gap is exactly where small business sites get taken.

Translate that to the stack you actually own. In our agency work, a small business WordPress install is a theme plus a couple dozen plugins, and most of those plugins are maintained by one or two people who are not paid for it. Those are precisely the projects this program is aimed at. So the realistic forecast for the next few quarters is a higher volume of published vulnerabilities affecting the same code you already run — not because your site got weaker, but because the scanning got better. Your exposure is no longer a function of how good your plugins are. It is a function of how fast you update them.

The no-human-review design has a second consequence worth doing the arithmetic on. A true-positive rate above 90% means something close to one report in ten is wrong, and Anthropic specifically warns that severity ratings may be off. For a maintainer, that is noise mixed into signal with no triage layer. Expect some genuine findings to sit in a queue behind false ones. Expect some severity labels to be wrong in both directions. Anthropic clearly anticipates this — it funds coordination groups whose whole purpose is keeping maintainers from drowning in reports — but the funding does not change the throughput of a single unpaid human.

There is also a symmetry problem. Defensive scanning at this scale is now a public, funded, announced program. Offensive scanning at this scale is neither public nor announced, and nothing about the underlying capability is exclusive to one lab. The same model class that writes a proof of concept for a maintainer writes one for someone else. The reasonable planning assumption is that the interval between “vulnerability published” and “vulnerability exploited in the wild” keeps compressing. Patch cadences built for a world of monthly maintenance windows were already behind. They are further behind now.

For anyone running more than one site, this reframes the work. Security stops being an audit you commission once a year and becomes a patch pipeline you operate every week. The leverage is not in finding problems — a free frontier model is doing that for you now — it is in shortening the distance between a release landing upstream and that release running on production. Centralized update management, a staging environment that actually gets used, and automatic updates for low-risk plugins beat any amount of scanning you could buy.

One clarification, because the headline invites the wrong read: this does not scan your website. It scans enrolled open-source projects. You benefit downstream, passively, and only if you install the fixes.

What this means for your business

• Turn on automatic updates for plugins today, then audit the exceptions. In WordPress, enable auto-updates for every plugin that does not touch checkout, forms, or custom code. Keep a short written list of the ones you update by hand and why.
• Cut your patch window to seven days and measure it. Write down the date each security release lands upstream and the date it reaches production. If that gap is routinely over a week, you have an operations problem, not a security-tooling problem.
• Inventory your plugins and delete what you do not use. Deactivated plugins still ship vulnerable code. Every plugin you remove is one fewer project whose disclosure queue you are now downstream of.
• Subscribe to vulnerability alerts for the ten plugins you depend on most. You want to hear about a release from a feed you control, not from a client asking why their site is showing someone else’s content.
• Confirm you have a restorable backup, not just a backup. Restore one to a staging site this month. An untested backup is a receipt, not a recovery plan.

Is my website being scanned by Anthropic?

No. OSS Scanner scans open-source projects whose maintainers opt in. Your site is affected only indirectly, through the plugins and themes built on those projects.

Does this make WordPress less safe?

The code is no weaker than it was last month. What changes is how quickly flaws become public knowledge, which raises the cost of a slow update habit.

The scanner’s design, its limits, and Anthropic’s own caveats are in the original report: Anthropic launches free AI security scans for open-source projects, by Stevie Bonifield for The Verge.

---