Summary
Anthropic has launched a cyber mission that pairs security support for critical infrastructure with free, opt-in AI vulnerability scans for open-source projects. The company says OSS Scanner reports are generated without human review.
Anthropic has launched the Anthropic Cyber Mission, a long-term effort to provide tools, research and resources to people securing critical infrastructure and open-source software. Its first initiatives are a program supporting operational-technology defenders and OSS Scanner, a free service that periodically scans enrolled open-source projects with Anthropic’s most capable models.
The announcement reflects a problem the company says it encountered through Project Glasswing: AI models can help find vulnerabilities, but checking findings, deciding which to fix and getting patches into use remain difficult and often depend on people. The new programs are intended to help defenders with that work.
Support for operational-technology defenders
Anthropic’s Critical Infrastructure Defense Program will bring Claude models, on-site engineers and threat research to trusted providers that work with operators of power grids, water systems, factories and transportation networks. The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
These environments rely on operational technology (OT): controllers, control software and industrial networks used to operate physical processes. Such systems can be difficult to secure because equipment may be proprietary, changes can carry operational risks, and machinery often cannot be taken offline for a software patch. As a result, a known vulnerability may remain unresolved while operators and their providers work out how to address it safely.
Anthropic says the program is already underway, with several partners using Claude to fix vulnerabilities and help customers do the same. It is beginning with a small cohort of providers to learn which approaches are practical. The company describes AI as support for defenders’ work, rather than a substitute for the specialist knowledge needed to manage changes to running systems.
Free scans for participating open-source projects
OSS Scanner is an opt-in service for open-source projects. Enrolled projects will receive periodic scans, with each report containing a proof of concept showing how a bug could be exploited, an explanation and a suggested fix when one is available.
The service follows work under Project Glasswing, where Anthropic says it scanned hundreds of widely used open-source projects, had people review many potential vulnerabilities and disclosed findings privately to maintainers. Some maintainers wanted access to all model findings, including those not reviewed by a person. OSS Scanner is designed to provide that information more quickly.
That speed comes with a trade-off: Anthropic says scanner reports are model-generated and sent without human review, so some may contain inaccuracies, including an incorrect severity rating. The company expects a true-positive rate above 90% and says it will work to improve both that rate and fix quality. It recommends the service for projects with the capacity to assess and respond to findings; it says it will continue human-verified disclosures for projects that need them.
Anthropic also plans to expand the mission to more partners and sectors, and to work on speeding up vulnerability fixes and researching ways to build more secure software. The practical value of these efforts will depend on whether findings can be assessed and safely acted on—especially in infrastructure where a patch may require careful planning.