Introducing the Anthropic Cyber Mission

Anthropic has rolled out the Anthropic Cyber Mission, a long-term push aimed at helping defend the systems that keep power, water, transport, and software running. The company is starting in two places: critical infrastructure and open-source software. On the first front, it is launching the Critical Infrastructure Defense Program, or CIDP. On the second, it is shipping OSS Scanner, a free service that gives open-source projects regular security scans from Anthropic’s strongest models.

The pitch is straightforward, and the backdrop is not. Anthropic says frontier models can also be misused to exploit vulnerabilities and run cyber operations, while defenders are stuck with old systems, limited budgets, and, in the case of operational technology, equipment that often can’t simply be taken offline to patch. These are the systems that run grids, utilities, factories, and transport networks. A mistake can shut down a plant. A delay can leave a known flaw sitting there for years.

CIDP brings together frontier Claude models, on-site engineers, and Anthropic threat research for a first group of partners that includes Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. Anthropic says several partners are already using Claude to help fix vulnerabilities and to help customers do the same. The company is starting with a small cohort so it can figure out which approaches actually work in the messiness of real industrial environments.

The open-source effort is shaped by a different bottleneck: speed. Under Project Glasswing, Anthropic scanned hundreds of widely used open-source projects and sent human-reviewed disclosures to maintainers. OSS Scanner changes that flow. Enrolled projects get periodic scans from Anthropic’s most capable models, free, and the reports go out without human review. That makes them faster, but also less tidy. Anthropic says the reports can include mistakes such as the wrong severity rating, though it expects a true-positive rate above 90%.

Anthropic is also widening access to its Cyber Verification Program, which earlier this week absorbed Project Glasswing and now gives more defenders access to its most capable models. The company is funding groups around open-source security too, including the Python Software Foundation, Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation. The broader bet is clear: attackers already have highly capable AI tools. Anthropic wants defenders to catch up before the gap gets uglier.