OSS Scanner service (Anthropic)

OSS Scanner service (Anthropic)

[Stefan Weil via qemu development]

Dear all,

citing https://github.com/anthropics/oss-scanner:

"OSS Scanner is a service by Anthropic to scan critical open-source 
repositories for security vulnerabilities".

Unless QEMU maintainers already have access to the best available AI 
models, this might be a good chance to get such access. I think that 
QEMU matches the required criteria.

Best regards
Stefan W.

Re: OSS Scanner service (Anthropic)

[Alex Bennée]

Stefan Weil via qemu development <qemu-devel@nongnu.org> writes:

> Dear all,
>
> citing https://github.com/anthropics/oss-scanner:
>
> "OSS Scanner is a service by Anthropic to scan critical open-source
> repositories for security vulnerabilities".
>
> Unless QEMU maintainers already have access to the best available AI
> models, this might be a good chance to get such access. I think that
> QEMU matches the required criteria.

There have been offers from re-sellers but they main issue is what would
we do with even more bugs? Are they offering to do the triage work and
filter out the non-virt use case bugs and search for duplicated already
in the bug tracker?

I don't doubt they can find more bugs - but do we have the maintainer
bandwidth to deal with them? Is anyone volunteering to take on the
fire-hose?

>
> Best regards
> Stefan W.

-- 
Alex Bennée
Virtualisation Tech Lead @ Linaro

Re: OSS Scanner service (Anthropic)

[Daniel P. Berrangé]

On Sun, Oct 25, 2026 at 07:28:58PM +0000, Alex Bennée wrote:
> Stefan Weil via qemu development <qemu-devel@nongnu.org> writes:
> 
> > Dear all,
> >
> > citing https://github.com/anthropics/oss-scanner:
> >
> > "OSS Scanner is a service by Anthropic to scan critical open-source
> > repositories for security vulnerabilities".
> >
> > Unless QEMU maintainers already have access to the best available AI
> > models, this might be a good chance to get such access. I think that
> > QEMU matches the required criteria.
> 
> There have been offers from re-sellers but they main issue is what would
> we do with even more bugs? Are they offering to do the triage work and
> filter out the non-virt use case bugs and search for duplicated already
> in the bug tracker?
> 
> I don't doubt they can find more bugs - but do we have the maintainer
> bandwidth to deal with them? Is anyone volunteering to take on the
> fire-hose?

More bug reports to triage is a problem we absolutely do not need
to inflict on ourselves. We have no shortage of AI assisted bug
reports in our backlog right now that are being ignored due to
a severe lack of both maintainer time  and interest.


The only place I think we could fit in a new scanning capability
is in new patches on qemu-devel, such that the patch author is the
only person who will read and act on the feedback. ie so that the
project maintainers don't take on an additional burden.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|