Commenters are divided on whether Anthropic's AI security findings represent high-value, genuine vulnerabilities or an overwhelming volume of low-signal noise that burdens maintainers. The disagreement centers on the utility and quality of the reports, with some citing exceptional real-world impact while others describe a flood of false positives and redundant issues.
221 readable replies · Supporting reply 1 · Supporting reply 2 · Supporting reply 3 · Supporting reply 4anthropics
oss-scanner
Dockerfile2026–2026
anthropics / oss-scanner
oss-scanner
Discover this repository through its Hacker News conversations.
2Distinct people
2Mentions
0Explicit recommenders
1.8KGitHub stars
What to know before exploring
What it is
A public description has not been verified.
Where it is used
No documented product use was verified in the last source check.
What people are saying
No recommendation phrase was found in the indexed comments.
No classified warning is attached to this page. Read the discussions before treating silence as approval.
Also in these discussions
No other repository is repeatedly linked in the same discussions.
This week on Hacker News
Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 3:56:07 PM UTC.
Mentions over time
HN mentions by day2 dated mentions
Observed mentions: 2026-10-08 22:41:34 UTC to 2026-10-16 20:59:02 UTC.
Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.
View mention counts and date ranges
| Period | Start (UTC) | End (exclusive, UTC) | Mentions | Submissions | Comments |
|---|---|---|---|---|---|
| Oct 8 | 2026-10-08 00:00:00 UTC | 2026-10-09 00:00:00 UTC | 1 | 0 | 1 |
| Oct 9 | 2026-10-09 00:00:00 UTC | 2026-10-10 00:00:00 UTC | 0 | 0 | 0 |
| Oct 10 | 2026-10-10 00:00:00 UTC | 2026-10-11 00:00:00 UTC | 0 | 0 | 0 |
| Oct 11 | 2026-10-11 00:00:00 UTC | 2026-10-12 00:00:00 UTC | 0 | 0 | 0 |
| Oct 12 | 2026-10-12 00:00:00 UTC | 2026-10-13 00:00:00 UTC | 0 | 0 | 0 |
| Oct 13 | 2026-10-13 00:00:00 UTC | 2026-10-14 00:00:00 UTC | 0 | 0 | 0 |
| Oct 14 | 2026-10-14 00:00:00 UTC | 2026-10-15 00:00:00 UTC | 0 | 0 | 0 |
| Oct 15 | 2026-10-15 00:00:00 UTC | 2026-10-16 00:00:00 UTC | 0 | 0 | 0 |
| Oct 16 | 2026-10-16 00:00:00 UTC | 2026-10-17 00:00:00 UTC | 1 | 1 | 0 |
What Hacker News says
2 sourcesJOJoTurk·Oct 16, 2026Submission
Tell HN: Anthropic found 36 bugs (6 CVEs) in Pion, OpenAI missed them
We added Pion DTLS to Anthropic's OSS scanner last week (https://github.com/anthropics/oss-scanner/pull/93), and today we woke up to a report with 36 bugs, including 6 security vulnerabilities: 2 critical, 3 high, and 1 moderate. Four of them affect WebRTC.
Some of these vulnerabilities have been sitting in the codebase for over 4 years, surviving years of testing and security scans. It's funny that our inboxes are constantly spammed with AI-generated security reports from people using Codex and Claude, most of which flag pointless issues. Yet somehow, none of them caught these.
The funniest part? Anthropic also found 3 bugs that OpenAI's internal code review missed. I had asked OpenAI to review a new DTLS API since they use Pion and had a use case for it in SPED. Their review didn't flag any bugs. Anthropic found an authentication issue,
Read the rest
a deadlock, and a TLS KeyUpdate bug (Maybe their model ignored this one because it's not a WebRTC issue). Luckily, the API hasn't been released yet. The fixes: https://github.com/pion/dtls/pull/1236
Here are the security advisories for the CVEs Anthropic found (all of them are pre-chatgpt!):
Critical: DTLS handshake signature confusion allows peer impersonation - https://github.com/pion/dtls/security/advisories/GHSA-7c2r-jhm9-43vf
Critical: Client authentication bypass through premature session caching - https://github.com/pion/dtls/security/advisories/GHSA-hhpj-h56m-9f2p
High: Client authentication bypass with shared session stores - https://github.com/pion/dtls/security/advisories/GHSA-cqhp-ggp7-58qj
High: Unbounded handshake cache allows remote memory exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jm57-r6vj-mwg9
High: Oversized RSA keys allow CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-jp25-wc3w-p9xp
Moderate: Repeated certificate verification allows CPU exhaustion - https://github.com/pion/dtls/security/advisories/GHSA-qpgj-64qg-5m4r
The most annoying part is that neither company's models were willing to help with verifying or filtering the bugs, so we had to manually review them one by one (Spent all day :/
You can enroll here: https://github.com/anthropics/oss-scanner
In OSS Scanner by Anthropic