Anthropic has launched the Anthropic Cyber Mission, a long-term effort to supply defenders with AI tools, research and funding, with a focus on critical infrastructure and open-source software. The umbrella includes a new program for operators of industrial systems and a free vulnerability scanner for open-source projects, the company said in a blog post Thursday.

What Happened

The Critical Infrastructure Defense Program gives participants access to frontier Claude models, on-site engineers and threat research aimed at operational technology, the control systems that run power grids, water systems, transportation networks and government facilities. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.

The second piece, OSS Scanner, is a free, opt-in service for core maintainers of critical open-source projects. Anthropic says it will scan enrolled projects periodically with its most capable models and send reports that include a proof-of-concept exploit, an explanation of the flaw and a suggested fix where one is available. The company expects a true-positive rate above 90% and says the reports are generated by the model without human review so they reach maintainers faster.

RelatedBank of America Added 1,000 Contractors to Fix Flaws Found by Anthropic's Mythos

Anthropic also named groups it is funding: the Python Software Foundation, Alpha-Omega, the Linux Foundation's OpenSSF, the Apache Software Foundation, Akrites and Gold Eagle. A Defender Advantage Fund, which it calls 0xDAF, is meant to keep OSS Scanner free and pay for pilot programs. The post did not give dollar amounts.

Why It Matters

Anthropic's case rests on timing. The company argues that AI has made exploiting vulnerabilities cheaper while verifying, disclosing and fixing them remains slow, leaving defenders exposed in the near term. It forecasts that within about two years the balance will tip, with AI making it easier to catch bugs before release and to build secure software from the start.

Open-source maintainers sit at the center of that problem. Many critical libraries are run by small volunteer teams, and a flood of automated reports can be as much a burden as a help. By promising a high true-positive rate and including working exploits and draft patches, Anthropic is trying to make its reports actionable rather than another queue of unverified findings.

The infrastructure program addresses a different gap. Industrial control environments often run older equipment that is hard to patch, and the partner list mixes consulting firms with OT security specialists such as Dragos and Nozomi Networks and equipment makers such as Rockwell Automation and Hitachi. Booz Allen's Andrew Turner said in the announcement that the question is now how much control AI "can gain, and how quickly" over industrial processes.

Python code on a dark screen
Illustrative photo: Unsplash. Not a photograph of the reported event.

Existing Programs

The Cyber Mission folds in efforts Anthropic had already started. A cyber defense program for state, local, tribal and territorial governments, launched in June, has provided models and technical support to more than half of U.S. states and some large public infrastructure operators, the company said. That work covers code scanning, patching, incident response and red teaming.

Anthropic is also expanding its Cyber Verification Program, which gives vetted security professionals broader access to Claude's cyber capabilities with fewer safety blocks for defensive work. Its Claude for Open Source program offers maintainers free Claude Max subscriptions.

What to Watch

Critical infrastructure vendors and integrators can register interest in the defense program, and maintainers can enroll in OSS Scanner or apply for Claude for Open Source. Anthropic said it plans to add partners and sectors, scale scanner enrollment, explore automated triage and patching for projects that want it, and publish what it learns, including what did not work.

The first public test will be whether maintainers who opt in see the accuracy Anthropic is promising, and whether the scanner's reports lead to faster fixes in widely used packages.