Crypto firms turn to Anthropic AI to find security flaws

Crypto companies including Ethereum developer Nethermind and Bitcoin wallet ZEUS have applied for access to Anthropic's new AI security scanner, which uses Claude Mythos to identify software vulnerabilities before attackers exploit them.

• Ethereum developer Nethermind and Bitcoin wallet ZEUS requested access to Anthropic's free security scanning service.
• Anthropic says its scanner uses Claude Mythos and sends automated vulnerability reports without human review.
• Nethermind requested repository scanning, while ZEUS sought checks covering payments, private keys, and Lightning connections.
• Anthropic reports finding 29,000 candidate vulnerabilities, with only approximately 6,000 manually reviewed internally so far.

Anthropic launched the free OSS Scanner on October 8, allowing eligible open-source projects to receive automated reports identifying possible security weaknesses. The applications submitted on October 9 show growing interest among crypto developers in using advanced AI tools to examine code that handles transactions, private keys and blockchain infrastructure.

The program follows Anthropic's Project Glasswing initiative, which gave selected organizations access to powerful AI models for cybersecurity research. Unlike its existing disclosure process, the new service sends findings without waiting for human verification.

Crypto developers request access to Claude Mythos security scans

Ethereum client developer Nethermind was among the first blockchain projects to seek enrollment, submitting GitHub pull request #38 on Friday. The application requests security scanning across its repository, where developers maintain software used to interact with the Ethereum network.

Nethermind develops an Ethereum execution client, software that processes blockchain transactions and supports network operations. Its application would give the team access to AI-generated reports identifying potential weaknesses in its code, provided Anthropic approves the request.

Bitcoin and Lightning wallet ZEUS submitted a separate application, seeking checks on its mobile application and components that handle payments, private keys and Lightning connections. The self-custodial wallet allows users to manage Bitcoin while retaining control of their funds.

VirtEngine, a decentralized cloud computing marketplace built using the Cosmos SDK, requested enrollment through another GitHub submission. The project develops infrastructure for decentralized computing services, making its software another potential candidate for the scanner.

The applications remain requests for participation, not confirmation that the projects have completed security audits. Anthropic evaluates submissions individually, considering their importance to infrastructure, exposure to remote attacks and how many other systems depend on their software.

Other applicants include developers of AI assistants, security tools, machine-learning infrastructure and cloud storage systems. Anthropic has not announced a fixed timetable for approving the crypto projects or delivering their first reports.

Anthropic says AI scanner found thousands of security flaws

Anthropic developed OSS Scanner after discovering that its AI models could identify potential software flaws faster than researchers could manually review them.

Over the past six months, the company said its models identified more than 29,000 candidate vulnerabilities in widely used open-source projects. Researchers had manually reviewed approximately 6,000 findings, leaving a large backlog awaiting assessment.

In response, Anthropic introduced an automated system that sends reports directly to participating maintainers. The company said the service would use its strongest models, including Claude Mythos, to generate findings and suggested fixes.

"These reports will be generated by our strongest models (including Claude Mythos)," Anthropic stated in its announcement.

Unlike conventional security audits that involve manual review before disclosure, OSS Scanner generates reports without human verification. Anthropic acknowledged that some findings could be inaccurate, including incorrect severity ratings or vulnerabilities that do not apply to a project's security design.

During early testing, external penetration testers examined 97 high-severity and critical findings across 48 projects. Anthropic reported that 85 findings, approximately 88%, met its standards for coordinated vulnerability disclosure.

Among the remaining 12 findings, 11 were genuine issues that duplicated existing reports or known vulnerabilities. One was invalid.

The company said its scanner provides reproducible examples of identified weaknesses, explanations of affected code and suggested patches when available. Participating crypto developers must review those findings themselves before deciding whether changes are necessary.

Anthropic will continue its existing human-reviewed vulnerability disclosure process for projects unable to handle large quantities of automated reports.

The launch follows several security incidents in which blockchain companies reported attacks involving automated tools or suspected AI assistance.

In August, Bitcoin swap provider Boltz suspended operations following months of AI-assisted attacks. The company said attackers were identifying weaknesses faster than its developers could investigate and repair them.

Boltz halted its swap services on August 3 after reporting several contained exploits. According to the team, its self-custodial design prevented customer funds from being exposed, although the company absorbed operational losses.

The interruption affected services that relied on Boltz infrastructure, including ZEUS. The wallet temporarily disabled swap functionality following the shutdown, while a separate ZEUS cybersecurity incident prompted the team to take some infrastructure offline for review.

Another security initiative, Bitcoin Red Team, reported identifying 4,962 potential vulnerabilities across 390 Bitcoin-related projects during approximately 30 hours of AI-assisted code reviews in August.

The Bitcoin security review classified 720 findings as high or critical severity, although the reported issues required verification before being treated as confirmed vulnerabilities.

Anthropic's earlier Project Glasswing program has attracted established industry participants. In August, Kraken parent company Payward joined the Claude Mythos security program to examine its systems for software weaknesses.

The company said it intended to scan its environments and share validated findings affecting third-party open-source projects with their maintainers.

OSS Scanner forms part of the Anthropic Cyber Mission, announced on October 8 to support software security and the protection of critical infrastructure.

Alongside the scanning service, Anthropic introduced the Critical Infrastructure Defense Program, which provides AI models, engineering support and threat research to organizations protecting power grids, transportation networks and industrial systems.

The initiative includes partnerships with CrowdStrike, Accenture, Deloitte, Palo Alto Networks and several other cybersecurity and technology companies.

For open-source developers, Anthropic is offering regular security scans at no cost to approved projects. Maintainers can apply through the OSS Scanner GitHub repository using the published enrollment template.

Eligibility decisions will consider whether the project has a "critical impact on infrastructure and user security," along with the team's ability to review and address reported vulnerabilities.

Anthropic has not announced how many crypto projects it will ultimately accept. Approved maintainers will receive model-generated reports through the service, while the company continues offering human-reviewed disclosures through its existing security process.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.