Anthropics oss-scanner would be interesting.

I imagine some intelligence agencies would have access to this already. What is the likelihood of them scanning some projects of interest already?

If you assume the above to be true, there is little to lose from submitting for automated scans.

It will be cool when self hosted AI can scan any project that you use as a safety check of FOSS code!