Anthropic opens a free Claude vulnerability scanner for OSS repos
Enroll by PR; scans run with no human review, so expect false positives. Plus Claude Code 2.1.296, an AWS AgentCore takeover, and Claude's new ToS.
Copy markdown
Free Claude bug-hunting for your open-source repo
Anthropic's opt-in OSS Scanner audits enrolled repos for free: a core maintainer opens a PR with a YAML config and a Dockerfile, and Claude's top models (incl. Claude Mythos) scan on a schedule and email findings. The catch — reports are fully model-generated with no human triage (~4,800 unverified already sent), there's no 90-day disclosure clock on them, and consumer terms mean your code can train models.
Claude Code 2.1.296 tightens agent workflows
The Oct 9 release adds CLAUDE_CODE_WORKFLOW_SUBAGENT_MODEL to pin every workflow subagent to one model, a per-subagent autoCompactWindow, and a backoff cap for overloaded (529) retries; it also doubles the MCP tool-description limit to 4,096 chars. If you orchestrate subagents or wire up MCP servers, these remove real papercuts.
One prompt hijacked every AWS AgentCore agent in a region
Zenity's 'AgentCorruption' chain showed a single prompt to a public-facing Bedrock AgentCore agent could compromise other agents in the same AWS account and region; AWS responded by enforcing IMDSv2 for new agents. Building on AgentCore? Audit cross-agent trust boundaries and confirm IMDSv2 now.
Claude's new usage policy kicks in Nov 12
Anthropic's updated Usage Policy bans sustained abusive behavior toward Claude and adds a section restricting election and democratic-process deception, effective November 12. If your product routes adversarial or political-content prompts through Claude, review the terms before the deadline.
Prime Agent gets a Rust rewrite
A Rust rewrite of Prime Intellect's open-source Prime Agent coding harness hit the Hacker News front page, with the team reportedly citing ~14x faster startup and ~80% lower memory versus the TypeScript build. If you spin up many parallel agents or run the harness in CI, the resource cut is the story.