Anthropic launches free Cyber Mission program to protect critical infrastructure

Anthropic launched the Cyber Mission program on October 8, 2026, combining critical infrastructure defense with automated security tools for open-source software. Eleven founding partners, including CrowdStrike, Deloitte, and Rockwell Automation, joined the initiative to safeguard operational technology in power grids and water systems. Simultaneously, Anthropic released the free OSS Scanner to automatically detect and patch code flaws, backed by testing that verified 85 of 97 severe findings across 48 projects.

Launch and origin of the Cyber Mission

• ▪Anthropic PBC launched the Anthropic Cyber Mission, an umbrella initiative encompassing critical infrastructure protection and open-source vulnerability scanning, on October 8, 2026
• ▪The Anthropic Cyber Mission draws on lessons from Anthropic's Project Glasswing, an earlier initiative that provided vetted organizations with access to Anthropic's Claude Mythos model starting in April 2026

Details of the Critical Infrastructure Defense Program

• ▪Eleven founding partners joined Anthropic's Critical Infrastructure Defense Program, including Accenture, Booz Allen Hamilton, Deloitte, PwC, CrowdStrike, Palo Alto Networks, Dragos, Insane Cyber, Nozomi Networks, Hitachi, and Rockwell Automation
• ▪Anthropic's Critical Infrastructure Defense Program provides power grid, water system, and transportation network operators with access to Claude models, onsite engineers, and threat analysis
• ▪Anthropic's Critical Infrastructure Defense Program targets operational technology in industrial plants, substations, and water systems where legacy equipment often cannot be taken offline for software patching

Operation and funding of OSS Scanner

• ▪Open-source project maintainers can enroll in Anthropic's OSS Scanner service by submitting a pull request to a designated Anthropic GitHub repository
• ▪Anthropic launched OSS Scanner, a free standing service providing eligible open-source projects with periodic automated vulnerability scans, reproducer code, code bisections, and proposed patches from its strongest models
• ▪Anthropic's OSS Scanner is funded by the Defender Advantage Fund, which was established in August 2026 to keep automated security vulnerability scanning free for open-source maintainers
• ▪Anthropic stated that its OSS Scanner reports are delivered directly to open-source maintainers without human review, meaning some reports may contain errors such as incorrect severity ratings

Vulnerability scanning results and trials

• ▪In pre-launch testing across 48 open-source projects, expert penetration testers vetted 97 critical and high-severity findings from an early version of Anthropic's OSS Scanner and cleared 85 for public disclosure
• ▪Encryption library developer wolfSSL Inc. reported that all but two of the 74 vulnerability reports received from Anthropic's automated scanner during early trials were valid, with five resulting in assigned CVEs
• ▪Anthropic's AI models identified more than 29,000 candidate vulnerabilities in widely used software over the past six months, leading to nearly 5,000 direct reports sent to maintainers

Cyber risk reduction challenges

• ▪Anthropic stated that finding vulnerabilities with AI has become significantly easier, but verifying, prioritizing, and repairing those flaws remains slow human-dependent work
• ▪Anthropic stated that its Project Glasswing had not yet cut cyber risk by enough before being folded into its expanded Cyber Verification Program

Industrial AI threat assessment

• ▪Andrew Turner, president of commercial cyber at Booz Allen Hamilton, identified operational technology as the next frontier for autonomous AI-enabled cyberattacks
• ▪Andrew Turner stated that the key issue facing industrial systems is how much control artificial intelligence can gain over an industrial process and how fast

AI balance between attackers and defenders

• ▪Anthropic argued that cyber attackers already possess powerful artificial intelligence models while defenders still lack comparable tools
• ▪Anthropic projected that artificial intelligence capabilities will favor cybersecurity defenders over attackers within two years

Debatable claims

• ▪Current AI models remain ineffective at reducing systemic cyber risk
• ▪Integrating AI models into critical operational technology risks severe disruption to physical infrastructure
• ▪In the current AI era, offensive cyber capabilities have a near-term advantage over defensive measures
• ▪Unreviewed AI vulnerability reports create an unsustainable workload for open-source maintainers