Anthropic Launches Cyber Mission to Protect Critical Infrastructure and Open-Source Software

Anthropic has announced the Anthropic Cyber Mission, a long-term initiative designed to strengthen cybersecurity across critical infrastructure and open-source software. Announced on 8 October 2026, the programme brings together AI capabilities, engineering expertise, threat research and funding to help defenders identify and address security weaknesses.

The initiative begins with two priorities: protecting operational technology used by essential services and improving the security of open-source software that underpins much of today's digital infrastructure.

Anthropic is introducing two key efforts under the initiative: the Critical Infrastructure Defense Program (CIDP), which supports organisations responsible for protecting industrial and essential systems, and OSS Scanner, a free service that provides participating open-source projects with recurring AI-powered security scans.

The announcement builds on Anthropic's previous cybersecurity work, including Project Glasswing and its expanded Cyber Verification Program. The company says the new initiative is intended to address a persistent challenge: discovering vulnerabilities is only part of the process. Security teams must also validate findings, prioritise risks and implement fixes safely.

Why Anthropic Is Expanding Its Cybersecurity Efforts

AI models can support defensive security work, but they can also be misused to discover vulnerabilities and conduct cyber operations. Anthropic says highly capable AI tools are now available to attackers, while many defenders continue to face limited resources and lengthy remediation processes.

The gap is particularly important for critical infrastructure and open-source software. Both are essential to modern services, yet maintaining their security can require specialist knowledge, coordination and sustained funding.

Project Glasswing helped Anthropic and its partners identify vulnerabilities in widely used open-source projects. However, the company says those efforts also demonstrated that finding weaknesses does not automatically reduce cyber risk.

Vulnerability reports must be assessed, communicated to the appropriate maintainers and resolved. In industrial environments, the process is even more difficult because applying a patch can interrupt physical operations or create safety risks.

The Cyber Mission aims to address these challenges by supporting the organisations and people responsible for securing these systems.

1. Critical Infrastructure Defense Program Targets Industrial Security

The Critical Infrastructure Defense Program focuses on operational technology (OT), the hardware and software used to monitor and control physical processes.

Examples include the systems that manage power generation, water treatment, factory equipment and transportation networks. These environments differ from conventional IT systems because their security requirements are closely tied to physical safety, availability and operational continuity.

Many industrial systems are designed to operate for decades. They may rely on proprietary equipment, legacy software and networks that cannot easily be taken offline for maintenance. Consequently, vulnerabilities can remain unresolved when operators cannot safely apply updates.

Anthropic's new programme brings its Claude AI models, on-site engineering support and threat research to trusted providers that help critical infrastructure operators manage these risks.

The founding partners named in the announcement are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.

These organisations bring experience across cybersecurity services, industrial security, consulting and equipment manufacturing. Their involvement is intended to help translate AI capabilities into practical defensive work in complex operational environments.

Anthropic says the programme is already underway, with several partners working with Claude to fix vulnerabilities and help their customers do the same. The initial phase involves a small group of providers, allowing the participants to evaluate which approaches are effective and practical.

The company also acknowledges that AI cannot resolve every challenge associated with critical infrastructure security. Physical constraints, specialised equipment and the risks associated with changing live industrial systems remain important considerations.

2. OSS Scanner Brings Free AI-Powered Security Scanning to Open-Source Projects

The second major component of the Cyber Mission focuses on open-source software.

Open-source components are widely used across applications, cloud platforms, developer tools and enterprise systems. Many projects depend on maintainers who must balance security work with limited time and resources.

Anthropic says it scanned hundreds of widely used open-source projects under Project Glasswing. Potential vulnerabilities were reviewed by people in many cases and privately disclosed to maintainers through its coordinated vulnerability disclosure process.

The company says some maintainers wanted access to all findings generated for their projects, including results that had not undergone human review. OSS Scanner was introduced in response to that request.

The service is opt-in and provides enrolled projects with periodic security scans using Anthropic's most capable models, free of charge.

Each report includes:

• A proof of concept illustrating how a reported bug could be exploited.

• An explanation of the potential vulnerability.

• A suggested fix when one is available.

There is an important qualification. Anthropic states that OSS Scanner reports are generated by models and sent without human review. This allows findings to reach maintainers faster, but some reports may contain inaccuracies, including incorrect severity ratings.

The company expects the service to achieve a true-positive rate above 90% and says it will work to improve both detection quality and the quality of suggested fixes over time. This figure is Anthropic's stated expectation, not a guarantee that every report will be correct.

Anthropic also says the service is intended for projects with enough capacity to review and act on the findings. For projects that need a more controlled process, the company will continue to share human-verified vulnerability disclosures under its coordinated disclosure policy.

How OSS Scanner Fits Into the Software Security Process

AI-generated findings are useful only when maintainers can evaluate and address them. A vulnerability report should therefore be treated as a starting point for investigation rather than automatic proof that a project is vulnerable.

A practical workflow involves reviewing the affected code, reproducing the issue where appropriate, assessing its severity, developing and testing a patch, and coordinating disclosure when necessary.

Anthropic's broader open-source plans include accelerating vulnerability triage and patching, expanding the scanner to more projects and researching secure software architectures and coding practices.

The company also says it has funded organisations that support open-source infrastructure, including the Python Software Foundation, Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation. It has additionally supported Akrites and Gold Eagle, which coordinate vulnerability reports from multiple sources.

The Defender Advantage Fund, launched in August, supports pilot programmes in these areas and helps keep OSS Scanner free.

3. Cyber Verification Program Expands Access for Security Teams

The Cyber Mission also builds on Anthropic's expanded Cyber Verification Program (CVP).

Anthropic says Project Glasswing has been merged into the expanded programme, which gives more defenders access to its most capable models for eligible cybersecurity work.

The broader objective is to make advanced AI capabilities available to qualified security professionals conducting defensive work, including efforts to identify weaknesses and strengthen systems.

The Cyber Mission announcement does not describe the expanded verification programme as a replacement for human expertise. Instead, the initiative combines access to AI models with engineering support, threat research and collaboration with organisations that understand the environments they protect.

For critical infrastructure, this matters because a vulnerability that appears straightforward to fix in software may require careful planning when it affects an operating industrial system. For open-source projects, the main challenge may be the capacity to investigate reports and maintain secure releases.

Access to advanced models is therefore only one part of the defensive process. Verification, remediation and operational decision-making remain essential.

4. Funding and Collaboration Form Part of the Strategy

Anthropic's announcement extends beyond its two newly introduced services.

The company says it will deploy engineering talent and provide tools and funding to organisations working to secure critical infrastructure and open-source software.

Its existing efforts also include a cyber defence programme for state, local, tribal and territorial governments in the United States. Anthropic says that, since the programme launched in June, it has offered advanced Claude models and technical support to more than half of US states and some of the country's largest public critical infrastructure operators.

The company describes its approach as collaborative, working with private companies, public institutions, governments and nonprofits that already understand the systems they protect.

It also plans to expand the Critical Infrastructure Defense Program to additional partners and sectors over the coming months. For open-source security, it intends to extend scanning coverage, improve the handling of vulnerability findings and share research on more secure software design.

These are stated plans rather than completed outcomes. Anthropic says it expects the Cyber Mission to evolve as participants learn which methods work and which do not.

5. What the Cyber Mission Means for Cybersecurity

Anthropic's announcement highlights a wider industry challenge: AI may make vulnerability discovery more accessible, but effective defence also requires reliable verification, prioritisation and remediation.

For critical infrastructure operators, the potential value lies in helping security specialists analyse complex environments and address weaknesses without compromising operational safety. Any practical benefit will depend on how AI-assisted recommendations are assessed and applied within each environment.

For open-source maintainers, free recurring scans could provide an additional way to identify potential vulnerabilities. However, maintainers will still need the time and expertise to review findings, distinguish genuine issues from false positives and produce reliable fixes.

For enterprises, the announcement reinforces the importance of treating vulnerability management as an end-to-end process. Detection tools alone cannot eliminate risk if organisations lack the resources or procedures needed to validate and remediate findings.

These implications are analysis based on the initiative's stated objectives. Anthropic has not yet disclosed comprehensive outcome data demonstrating the programme's overall effect on cyber risk.

6. Challenges That Remain

The Cyber Mission addresses meaningful security problems, but several practical challenges remain.

Accuracy of AI-generated findings: OSS Scanner reports are not human-reviewed before delivery. Maintainers must validate findings and determine the appropriate response.

Safe remediation: Industrial systems may require extensive testing and carefully scheduled maintenance before a vulnerability can be fixed. A technically correct patch is not necessarily safe to deploy immediately.

Limited defender resources: Smaller open-source teams and infrastructure operators may struggle to investigate every finding, even when scanning is free.

Measuring outcomes: The announcement outlines programme objectives and initial activities, but does not establish the overall reduction in vulnerabilities or cyber incidents attributable to the Cyber Mission.

Coordination across the ecosystem: Effective defence depends on communication among software maintainers, infrastructure operators, vendors, security researchers and public institutions.

Anthropic says it will share lessons from the programme, including approaches that do not work. That commitment could help the wider security community assess the initiative as more evidence becomes available.

Conclusion

The Anthropic Cyber Mission brings together critical infrastructure defence, open-source vulnerability scanning, advanced AI access, engineering support and funding under a long-term cybersecurity initiative.

Its immediate focus is practical: help defenders find weaknesses, assess them and move towards safer remediation. The Critical Infrastructure Defense Program targets the complex operational environments behind essential services, while OSS Scanner offers participating open-source projects free recurring AI-powered scans.

The initiative's significance will depend on execution. AI-generated findings must be reliable enough to investigate, industrial fixes must be safe to deploy, and maintainers need the resources to act on vulnerabilities.

Anthropic has outlined its priorities and initial activities, but the broader impact will become clearer as the programmes expand and verifiable results emerge.