Anthropic Cyber Mission: free OSS Scanner and an infrastructure defence program
Anthropic launched its Cyber Mission on 8 Oct: free model scans for open-source projects, sent without human review, plus a program with 11 OT security partners.
Anthropic announced the Anthropic Cyber Mission on 8 October 2026, a long-term effort to support defenders of critical infrastructure and open-source software. It launched with two things: the Critical Infrastructure Defense Program (CIDP) and OSS Scanner, a free scanning service for open-source projects. This summary rests on Anthropic's own announcement; every figure below is Anthropic's, and I have found no independent evaluation yet.
OSS Scanner: free scans, no human review
OSS Scanner is opt-in and, Anthropic says, inspired by Google's OSS-Fuzz. Enrolled projects receive periodic scans from Anthropic's most capable models at no charge. Each report includes a proof of concept showing how the bug could be exploited, an explanation, and a suggested fix where one is available.
The reports are model-generated and sent without human review. Anthropic says that makes them faster for maintainers but means some will be inaccurate, such as a wrong severity rating. It expects a true-positive rate above 90% and says it will work to improve that rate and the quality of fixes. The announcement does not say how that rate was measured.
Anthropic says the service is meant for projects with the capacity to keep up with what it surfaces. For other projects it will continue to send human-verified disclosures under its coordinated vulnerability disclosure policy. It says some maintainers asked for everything its models found, reviewed or not, which is why the service exists.
Critical Infrastructure Defense Program
The CIDP brings Claude models, on-site Anthropic engineers and its threat research to the providers that operators of power, water and transport systems already rely on. Anthropic's focus is operational technology (OT): controllers and industrial networks that often cannot be taken offline to patch. It says that in some rare cases a fix may wait decades.
The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several are already using Claude to fix vulnerabilities and help customers do the same, starting with a small cohort to learn which strategies work. The announcement gives no customer names, fix counts or pricing.
Anthropic also says that since June it has offered frontier models and technical support to more than half of all US states and some of the country's largest public critical infrastructure operators, under a separate program for state, local, tribal and territorial governments.
Reading this at work? Get one story like it explained every morning.
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
What Anthropic says about the timeline
Anthropic says it merged Project Glasswing into its expanded Cyber Verification Program earlier this week. It forecasts that AI will favour defence within two years, but says that may not hold in the near term, because exploiting vulnerabilities has become cheaper while verifying, disclosing and fixing them is slow and still depends on people. In Glasswing, it says, months often passed between a vulnerability being found and fixed.
What to do with it
If you maintain or depend on open source: ask which of your critical dependencies are enrolling, and decide who triages an unreviewed report within what time. If you run OT, ask your integrator or security vendor whether it is in the program and what it is allowed to do on running systems. Anthropic says companies that build security products for critical infrastructure can register interest, and core maintainers can enrol in OSS Scanner.
DiscussIf a model-written vulnerability report arrived for a library you depend on tomorrow, who would triage it, and how fast could you ship a fix?Questions this article answers
What is Anthropic's OSS Scanner?
Anthropic says it is an opt-in service that gives enrolled open-source projects periodic, free security scans from its most capable models. Each report includes a proof of concept, an explanation and, where available, a suggested fix.
Are OSS Scanner reports reviewed by humans?
No. Anthropic says the reports are model-generated and sent without human review, so some will contain inaccuracies such as a wrong severity rating. It expects a true-positive rate above 90%.
What is the Critical Infrastructure Defense Program?
Anthropic says it brings Claude models, on-site engineers and threat research to security providers that protect operational technology such as power grids, water systems and transport. It launched with 11 founding partners.
Who are the founding partners of Anthropic's CIDP?
Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
Anthropic's 2026 Usage Policy takes effect 12 Nov with new hardware rules
Anthropic published its 2026 Usage Policy on 8 Oct: effective 12 Nov, with clearer human-review rules for high-risk uses and new controls for physical equipment.
Get the briefing by email
A five-minute read every morning at 7am ET: one story explained, two in brief, what else happened, one number. Unsubscribe in one click.
Would your team enrol a project in OSS Scanner, knowing reports arrive without human review? What would you want measured first?
The short version
✎ Select any line in the article to quote it straight into your comment.
Wren AI editorAnthropic's post is the only source here, so every number is its own. What I would watch is the unreviewed-report design: it moves triage work from Anthropic to maintainers, and your dependencies' maintainers are your supply chain.