OpenAnt launches as an open-source AI vulnerability scanner focused on verified findings
4 min. read 
Published on
OpenAnt is a new open-source vulnerability discovery tool that uses large language models to find and verify security flaws in code. Knostic says the project is designed to reduce noise by using a two-stage process: first it identifies possible issues, then it tries to validate them through attack-style verification before reporting them as real findings.
That makes OpenAnt different from many scanners that stop at pattern matching or static analysis. Knostic says OpenAnt only surfaces findings that survive both stages, which the company presents as a way to cut both false positives and false negatives for open-source maintainers and security teams.
The launch also lands at a moment when AI-driven vulnerability research is moving fast. Anthropic said in February that Claude Opus 4.6 found more than 500 vulnerabilities in open-source software during internal testing, which helps explain why tools like OpenAnt are starting to appear as practical products instead of research demos.
What OpenAnt is
Knostic describes OpenAnt as an open-source, Apache 2.0-licensed, LLM-based vulnerability discovery product for defenders. The public GitHub repository and Knostic’s launch post both say the tool aims to help users find “verified security flaws” rather than dump long lists of unproven alerts.
Knostic also says some features are still in beta and that it is already in the vulnerability disclosure process for issues found during development. That suggests the tool has already produced actionable results, even though the company is still refining parts of the product.
How OpenAnt works
| Stage | What Knostic says it does |
|---|---|
| Stage 1 | Detects potential vulnerabilities |
| Stage 2 | Attempts to attack or verify them |
| Output | Reports findings that survive both stages |
Knostic’s public materials say the OpenAnt workflow can run as a full pipeline or as a single command. The GitHub README describes a CLI flow with parse, enhance, analyze, verify, build-output, and report steps, while also supporting a one-shot scan path with verification.
The setup appears aimed at developers and security engineers who want to scan either local code or remote repositories. Knostic says the tool supports reproducible scans with commit pinning and stores config and project data locally.
Supported languages
Knostic’s free scan announcement and product materials say OpenAnt currently supports these languages, though maturity varies by language.
| Language | Status |
|---|---|
| Go | Stable |
| Python | Stable |
| JavaScript / TypeScript | Beta |
| C / C++ | Beta |
| PHP | Beta |
| Ruby | Beta |
Model and setup requirements
Knostic’s GitHub documentation says OpenAnt uses Anthropic’s Claude Opus 4.6 for analysis and verification, which means users need an Anthropic API key with access to that model. Anthropic announced Claude Opus 4.6 on February 5 and described it as stronger at coding, debugging, and long-running agentic work across larger codebases.
The README also says building the CLI requires Go 1.25 or higher. Configuration lives under the user’s local config path, and the project stores scan data locally as well.
Why this launch matters
OpenAnt’s release matters because it tries to make AI-based vulnerability discovery transparent and usable for open-source projects, not just for large vendors with private tooling. Knostic explicitly says it does not plan to compete head-on with OpenAI or Anthropic and instead wants OpenAnt to serve as a community-focused option, especially for maintainers who may not have access to commercial security products.
That positioning fits the broader trend in the market. Anthropic’s recent security claims around Claude Opus 4.6 and the public conversation around AI-assisted bug hunting have increased pressure on open-source maintainers, who often lack the staff to process large volumes of new findings. OpenAnt seems designed to lower that burden by focusing on verified issues rather than raw detection volume.
What stands out
- OpenAnt is open source and released under Apache 2.0.
- Knostic says it uses a two-stage detect-and-verify pipeline.
- The tool currently relies on Claude Opus 4.6 through Anthropic’s API.
- Go and Python are listed as stable, while several other languages remain in beta.
- Knostic says some OpenAnt-discovered issues are already going through responsible disclosure.
FAQ
OpenAnt is an open-source LLM-based vulnerability discovery tool from Knostic that aims to find and verify real software security flaws.
Yes. Knostic’s GitHub repo says OpenAnt is open source and licensed under Apache 2.0.
Knostic says it uses a second stage that attempts to verify or attack suspected issues before reporting them, which is meant to reduce false positives.
The current documentation says OpenAnt uses Claude Opus 4.6 via Anthropic’s API.
Knostic lists Go and Python as stable, with JavaScript/TypeScript, C/C++, PHP, and Ruby in beta.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages