Anthropic Cyber Mission: AI support for cyber defenders

This article was automatically generated with the assistance of AI. All facts are sourced and dated.

In brief: On October 8, 2026, Anthropic launched the Anthropic Cyber Mission, a long-term effort to support cyber defenders. It starts with two programs: the Critical Infrastructure Defense Program (CIDP), which brings frontier Claude models, on-site engineers and threat research to the providers that secure operational technology, and OSS Scanner, a free, opt-in service that sends open-source maintainers model-generated security reports — explicitly without human review.

What is new

Anthropic frames the Cyber Mission as a response to a gap it describes itself: highly capable AI is now widely available to attackers, while defensive tools have not reached enough defenders. The company states that state-sponsored adversaries have spent years gaining footholds in critical systems, and that defenders of critical infrastructure and open-source software face severe resource shortages.

The mission builds on Project Glasswing, which Anthropic has since merged into its expanded Cyber Verification Program (announcement of October 6, 2026). Anthropic's own conclusion from Glasswing: partners uncovered many vulnerabilities, but finding them is no longer the bottleneck — verifying, prioritizing and fixing them is.

The two pillars at a glance

Pillar	Target group	What it delivers	Access and cost
Critical Infrastructure Defense Program (CIDP)	Trusted providers that secure operational technology (power grids, water systems, transportation, government systems)	Frontier Claude models, on-site engineers, threat research	Program with eleven founding partners; providers can register interest
OSS Scanner	Open-source projects, opt-in	Periodic scans with Anthropic's strongest models; reports with proof of concept, explanation and a suggested fix where available	Free; funded through the Defender Advantage Fund (0xDAF)

CIDP: AI support via trusted providers

The CIDP does not target operators directly. It works with the providers operators already rely on: consultancies, security vendors and the manufacturers that build and patch industrial equipment. The eleven founding partners named by Anthropic are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.

Anthropic writes that several partners are already working with Claude to fix vulnerabilities and help their customers do the same. The company also points to its June 2026 program for US state, local, tribal and territorial governments: since then, it says, frontier Claude models and technical support have reached more than half of all US states and some of the largest public critical infrastructure operators. These are vendor statements; an independent evaluation does not exist yet.

The rationale for the OT focus, according to Anthropic: operational technology often cannot be taken offline to patch, so known vulnerabilities can remain unresolved for years, and changes are risky, specialized work.

OSS Scanner: fast, model-generated reports — with explicit caveats

OSS Scanner is inspired by Google's OSS-Fuzz and is opt-in. Enrolled projects receive periodic scans from Anthropic's most capable models, free of charge.

Aspect	As stated in the announcement (October 8, 2026)
How it works	Opt-in enrollment; periodic scans with Anthropic's most capable models
Report contents	Proof of concept for exploitation, explanation, suggested fix where available
Review	Reports are model-generated and sent without human review
Expected quality	Anthropic expects a true-positive rate above 90 %; inaccuracies such as wrong severity ratings are explicitly possible
Cost	Free, funded through the Defender Advantage Fund (0xDAF)
Intended users	Projects with the capacity to keep up with findings; others continue to receive human-verified disclosures via Anthropic's CVD policy

The practical consequence for maintainers: these reports are triage input, not verified advisories. They arrive faster than classic coordinated disclosure, but every finding still needs the same verification and patch process as any other scanner output.

Context and what remains open

• Anthropic funds organizations behind widely used open-source code (Python Software Foundation, Alpha-Omega, OpenSSF via the Linux Foundation, Apache Software Foundation) and offers maintainers free Claude Max subscriptions through Claude for Open Source.
• Anthropic's forecast: in about two years, AI will favor defense. In the near term, it says, that may not hold, because exploiting vulnerabilities has become cheaper while verifying and fixing them stays slow. This is a vendor forecast, not a measurement.
• What we could not verify: the effectiveness of CIDP engagements and the real-world true-positive rate of OSS Scanner. No independent benchmark exists at the time of writing.

What enterprises should take away

1. OT operators: AI support will likely reach you through your existing security providers and equipment manufacturers, not directly. It is reasonable to ask those providers how they use frontier models today.
2. Software and IT teams: if OSS Scanner scales, vulnerability reports for open-source dependencies may arrive faster and more often. What decides risk is your own triage, prioritization and patch speed — an internally permission-controlled knowledge base for security findings keeps that process auditable (see CogLake's security page).
3. Security planning: treat vendor claims — including the “above 90 % true-positive” expectation and the two-year defense forecast — as dated statements of intent, not results.

Sources

• Anthropic: Introducing the Anthropic Cyber Mission, announcement of October 8, 2026 (read October 13, 2026).
• Anthropic news overview with dates of related announcements (Cyber Verification Program, October 6, 2026), read October 13, 2026.