Anthropic launches a Cyber Mission for OT defenders and open-source maintainers

Anthropic launched the Cyber Mission on October 8, a program it describes as a long-term commitment to support defenders with tools, research, and resources. It starts in two areas: critical infrastructure, through a new Critical Infrastructure Defense Program (CIDP), and open-source software, through OSS Scanner, a service that runs free vulnerability scans with Claude models. The timing is not random. Earlier that week Anthropic merged its Project Glasswing effort into an expanded Cyber Verification Program, and this mission is the next layer on top of that.

Critical infrastructure: models plus on-site engineers

The post opens on a specific problem. Power grids, water systems, factories, and transport run on operational technology, controllers and industrial networks built to last decades that often cannot be taken offline to patch. Known vulnerabilities can stay unresolved for years, and a wrong change can take a plant down.

CIDP answers with frontier Claude models, on-site Anthropic engineers, and threat research, delivered through the providers operators already trust rather than directly to the operators. The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation, a mix of consultancies, security vendors, and equipment manufacturers. Anthropic says several partners are already using Claude to fix vulnerabilities, and the first step is a small cohort to learn which strategies are practical. Companies that build security products or services for critical infrastructure can register interest.

This extends a program Anthropic launched in June for state, local, tribal, and territorial governments. Through it, the company says it has offered frontier models and technical support to more than half of all US states and some of the country's largest public critical-infrastructure operators.

Open source: free model scans, with the caveats spelled out

OSS Scanner is an opt-in service inspired by Google's OSS-Fuzz. Enrolled projects receive periodic scans from Anthropic's most capable models, free of charge. Each report includes a proof of concept for how the bug could be exploited, an explanation, and a suggested fix where one is available.

The announcement is unusually explicit about the trade-off: reports are model-generated and sent without human review. Maintainers get findings faster, but some will contain inaccuracies such as a wrong severity rating. Anthropic expects a true-positive rate above 90% and says it will work on improving the rate and the fix quality over time. The service targets projects with the capacity to keep up with surfaced findings; other maintainers continue to receive human-verified disclosures under the company's coordinated vulnerability disclosure policy.

The surrounding support includes funding for the Python Software Foundation, OpenSSF and Alpha-Omega through the Linux Foundation, and the Apache Software Foundation, plus support for Akrites and Gold Eagle, which coordinate vulnerability reports from many sources so maintainers are not overwhelmed. The Defender Advantage Fund, launched in August, funds pilot programs and keeps OSS Scanner free. Maintainers can also apply for free Claude Max subscriptions through Claude for Open Source.

The asymmetry Anthropic is betting against

The mission post's argument is that cyber-capable models are now widely available to attackers, while defensive tools have not reached enough of the people who need them. The cost of exploiting vulnerabilities has dropped, but verifying, disclosing, and fixing them is slow and still depends on people. In Glasswing, Anthropic says months often passed between a vulnerability being found and being fixed. In operational technology, a fix may have to wait for a safe maintenance window on running machinery, and in rare cases that wait can take decades.

Anthropic's own forecast is that in two years AI will favor defense: bugs easier to catch before they ship, more fundamentally secure software, and systems actively defended by models. That is a projection from the company making the bet, not an independent result. The post also says the mission will change over the coming years as Anthropic and its partners learn what works, and invites other AI developers, security companies, and governments to run and coordinate their own efforts.

If you maintain an open-source project that sees real traffic, the practical move is to weigh the scanner against your own triage capacity: faster findings, some noise, no human filter in between. If your business sits on operational technology, the entry point is the partner cohort, not the model directly.