Anthropic has launched Anthropic Cyber Mission, a long-term initiative focused on securing critical infrastructure and open-source software. It provides industrial systems defenders with Claude models, engineering support and threat research. For open-source maintainers, it also introduces OSS Scanner, a service that regularly searches for vulnerabilities and supplies explanations and suggested fixes where available.
OSS Scanner reports include proof-of-concept exploits
OSS Scanner is an opt-in service that gives enrolled projects regular security scans. Inspired by Google’s OSS-Fuzz, it uses Anthropic’s most capable models to run the checks. Scans are free for participating projects.
The output goes beyond flagging a possible bug. Each report explains the issue and includes a proof of concept showing how it could be exploited. When a suggested fix is available, the service includes it in the report.
The service builds on experience from Project Glasswing. Anthropic says it scanned hundreds of widely used open-source projects, had people review many potential vulnerabilities and privately reported findings to maintainers. Some maintainers able to handle larger volumes of reports then asked to receive findings that had not undergone human review as well.
Automated reports require capacity to handle findings
OSS Scanner reports are generated by a model and sent without human review. Anthropic says this gets findings to maintainers faster, but reports may contain inaccuracies, such as an incorrect severity rating. The company expects more than 90% of reported findings to be genuine vulnerabilities and plans to improve that share and the quality of suggested fixes over time.
The service is intended for projects whose maintainers can keep up with the findings it surfaces. For other projects, Anthropic will continue to provide human-verified reports under its coordinated vulnerability disclosure policy.
Claude and on-site engineers for industrial systems defenders
The initiative’s other component is the Critical Infrastructure Defense Program (CIDP). It provides trusted industrial security providers with advanced Claude models, on-site engineers and threat research. The program is starting with a small group of providers; Anthropic says this collaboration is intended to identify which approaches are effective and practical.
Anthropic highlights the particular demands of operational technology in power grids, water utilities, factories and transportation networks. These systems often cannot be taken offline to install security patches, and changes carry risks. As a result, the company says, known vulnerabilities can remain unresolved for years.
Founding partners include Accenture, Booz Allen, CrowdStrike and Deloitte. Dragos, Hitachi, Insane Cyber and Nozomi Networks have also joined. Palo Alto Networks, PwC and Rockwell Automation complete the founding group.
According to Anthropic, several partners are already using Claude to fix vulnerabilities and help their customers do the same. Over the coming months, the company plans to expand CIDP to more partners and sectors and share lessons, including approaches that did not work.
Automated fixes are a planned next step
For open-source software, Anthropic plans to bring OSS Scanner to more projects. It also intends to automate the sorting of findings and patching for projects that want it. Beyond fixing individual bugs, the company plans to research more secure software architectures and methods for hardening or rewriting code.
How to join the defense programs
Companies that provide security products or services for critical infrastructure can already register their interest in CIDP. Another route to model access is the expanded Cyber Verification Program, into which Anthropic merged Project Glasswing earlier this week.
Security teams of any size can apply for model access through the Cyber Verification Program. This includes critical infrastructure operators and open-source project maintainers.
