Anthropic's Cyber Mission: What It Actually Contains

Anthropic launched the Anthropic Cyber Mission this week: a long-term program that puts frontier models, engineers, and funding behind the defenders of critical infrastructure and open-source software. The announcement is dense, so this post breaks down what is actually in it, what each piece does, and where the honest caveats are.

The core problem they are attacking

The asymmetry is simple: the cost of exploiting a vulnerability has collapsed, while the cost of verifying, disclosing, and fixing one has not. Anthropic says that under Project Glasswing, their earlier vulnerability-finding effort, months often passed between a bug being found and being fixed. The bottleneck is no longer discovery. It is triage, prioritization, and patching, and all three still depend on people.

There is also a resource problem layered on top. Power grids, water systems, and transport networks run on operational technology built to last decades. That equipment often cannot be taken offline to patch, so known vulnerabilities stay unresolved for years. And most open-source software, which nearly all software depends on, is maintained by small volunteer teams with no security budget. Attackers have industrialized. Defenders have not.

Pillar one: the Critical Infrastructure Defense Program

The first launch under the Cyber Mission is the Critical Infrastructure Defense Program (CIDP). Anthropic brings frontier Claude models, on-site engineers, and threat research to the trusted providers that operators already rely on: the consultancies, security vendors, and equipment makers who tell utilities what is exposed and which fixes to apply on running systems.

The founding partner list is notable because of who is on it:

• OT specialists: Dragos, Nozomi Networks, Rockwell Automation, Hitachi
• Big security: Palo Alto Networks, CrowdStrike
• Consulting: Accenture, Booz Allen, Deloitte, PwC
• Others: Insane Cyber

That mix matters. Securing a substation is not the same skill set as securing a web app. The equipment is proprietary, changes are risky, and a mistake can take down a plant. Anthropic is explicitly not going direct to utilities; it is working through the companies that already hold those relationships. This builds on a program launched in June for US state, local, tribal, and territorial governments, which has since reached more than half of US states.

Pillar two: OSS Scanner for open source

The second launch is more interesting for most developers reading this. OSS Scanner is a free, opt-in service for open-source projects. Enrolled projects get periodic security scans from Anthropic's strongest models, and each report includes:

• A proof of concept showing how the bug could be exploited
• An explanation of the vulnerability
• A suggested fix, where one is available

It is explicitly inspired by Google's OSS-Fuzz, but for model-driven vulnerability discovery instead of fuzzing.

Two details deserve attention. First, the reports are model-generated and sent without human review, so maintainers get findings faster but some reports will be wrong, and Anthropic admits this openly, stating they expect a true-positive rate above 90% and committing to improve it. Second, the service is aimed at projects with the capacity to keep up with the findings. Projects that cannot handle that firehose still get the older treatment: human-verified reports through Anthropic's coordinated vulnerability disclosure process.

That second point is a rare piece of honesty in AI product launches: a tool can be technically impressive and still be wrong for a maintainer with no time.

What they learned from Project Glasswing

The announcement credits Glasswing with uncovering many vulnerabilities but admits it did not achieve a sufficient reduction in cyber risk. Finding bugs got easy; fixing them did not. That failure is the whole reason the Cyber Mission exists in this shape. Glasswing has been merged into the expanded Cyber Verification Program, which gives qualifying security professionals access to more capable models with reduced blocking classifiers for defensive work.

The funding side is real too. Anthropic says it has funded the Python Software Foundation, Alpha-Omega, OpenSSF through the Linux Foundation, and the Apache Software Foundation, plus the Defender Advantage Fund (0xDAF) launched in August, which backs pilot programs and keeps OSS Scanner free. Maintainers can also apply to Claude for Open Source for free Claude Max subscriptions.

The forecast, and the caveat

Anthropic's own forecast: in two years, AI will favor defense. Easier to catch bugs before they ship, easier to write secure software from scratch, easier to actively defend systems. But they say the near term may not be true yet, because while exploitation got cheap, verification and patching are still slow and human-bound. With operational technology, a fix may wait until it can be safely applied to running machinery. In rare cases, they say, that can take decades.

That framing is worth taking seriously. Success, as they define it, is water, power, transport, and communications keeping running under attack from capable adversaries, with fewer exploitable paths and faster recovery. That is a years-long goal, not a launch-day feature.

What this means if you maintain an open-source project

• If your project is widely used and you have capacity to review findings, look at enrolling in OSS Scanner. It is free and opt-in.
• If you cannot keep up with a stream of unverified reports, skip it and rely on human-verified disclosure instead.
• Free Claude Max subscriptions are available through Claude for Open Source, and expanded model access for defensive security work through the Cyber Verification Program.

My take

The strongest part of this announcement is what it admits. It admits Glasswing did not reduce risk enough. It admits OSS Scanner reports will contain errors and names an expected true-positive rate. It admits AI cannot fix the parts of critical infrastructure defense that are about physics, access, and organizational capacity. That level of candor is unusual, and it makes the claims that remain easier to evaluate.

The open question is whether defender-side distribution can catch up. Anthropic's own statement is that highly capable AI models are widely available to attackers now, while defensive tools have not reached enough of the defenders who need them. The Cyber Mission is essentially a distribution strategy: partner with the trusted providers, fund the foundations, give the scanners away. Whether that closes the gap faster than attackers widen it is the thing to watch over the next two years.

Sources: Anthropic Cyber Mission announcement, OSS Scanner research post, Cyber Verification Program