On October 8, 2026, Anthropic announced the launch of the Anthropic Cyber Mission, a long-term commitment to help secure systems that societies depend on. The initiative will provide tools, research, and resources to defenders, beginning with two focus areas: defending critical infrastructure and improving the security of open-source software.
Defending critical infrastructure: the Critical Infrastructure Defense Program (CIDP)
Anthropic said it will start by addressing operational technology (OT) used in power grids, water systems, transportation networks, factories, and government systems. These OT environments often run on controllers and software designed to last decades, and cannot always be taken offline for patches, which makes known vulnerabilities persist.
To support defenders, Anthropic announced the Critical Infrastructure Defense Program (CIDP). The program pairs Anthropic’s frontier Claude models with on-site engineers and threat research and delivers those capabilities to the trusted providers operators rely on. The CIDP’s founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.
Anthropic says several partners are already using Claude to find and remediate vulnerabilities and to assist customers. The company emphasized that OT security is specialized: equipment is often proprietary, changes carry risk, and mistakes can force shutdowns. CIDP will begin with a small cohort of providers to identify the most effective and practical strategies. Companies that build security products or services for critical infrastructure can register their interest to join as the program expands.
The announcement included statements from partner organizations underlining the need for industry-wide coordination, machine-speed defenses against AI-enabled attackers, and combining operational expertise with frontier AI capabilities.
Securing open-source software: OSS Scanner and other support
Recognizing that nearly all software depends on open-source components—often maintained by small teams—Anthropic described work under Project Glasswing, during which the company scanned hundreds of widely used open-source projects and privately reported findings through a coordinated vulnerability disclosure process.
In response to maintainers’ requests, Anthropic is launching OSS Scanner, an opt-in, free service that delivers regular security scans conducted by Anthropic’s most capable models. Enrolled projects receive periodic, model-generated reports that include a proof-of-concept for how a bug could be exploited, an explanation, and a suggested fix when available. Reports are sent without human review, enabling faster delivery but potentially introducing inaccuracies such as incorrect severity ratings.
Anthropic expects OSS Scanner’s true-positive rate to be above 90% and intends to improve true-positive rates and fix quality over time. The service is intended for projects that can keep pace with surfaced findings; projects unable to do so can continue to receive human-verified disclosures under Anthropic’s coordinated vulnerability disclosure policy.
OSS Scanner is the first step in a broader open-source program whose goals include: getting findings to maintainers faster; expanding OSS Scanner while retaining human-verified disclosure for projects that need it; accelerating fixes; automating triage and patching where desired; and researching and sharing secure architectures and coding practices with projects that want to go beyond patching.
Anthropic said it has funded organizations behind widely used open-source code, including the Python Software Foundation, Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation. It also supports Akrites and Gold Eagle, initiatives that aggregate and coordinate vulnerability reports to avoid overwhelming maintainers. The Defender Advantage Fund (0xDAF), launched by Anthropic in August, supports pilot programs in these areas and helps keep OSS Scanner free.
Maintainers can also apply to Claude for Open Source for free Claude Max subscriptions, and security teams may apply to the expanded Cyber Verification Program for access to Claude’s cyber capabilities for defensive work.
Project Glasswing, Cyber Verification Program, and rationale
Anthropic said that while Project Glasswing uncovered many vulnerabilities, the work had not yet reduced cyber risk sufficiently. Glasswing has been merged into an expanded Cyber Verification Program that gives many more defenders access to Anthropic’s most capable models.
The company argues that frontier AI models can be misused by attackers, but they also present an important opportunity to strengthen defense when applied responsibly, rigorously validated, and deployed with safety and reliability in mind. Anthropic forecasts that in two years AI will favor defense—making it easier to find bugs before release and to write more secure software—but acknowledges that in the near term attackers may have an advantage because exploit costs have dropped while verification and patching remain slow and human-dependent. In OT environments, fixes can sometimes be delayed for long periods until safe deployment is possible.
Success, Anthropic says, means critical services such as water, power, transport, and communications continue operating despite capable adversaries, with fewer exploitable attack paths and faster recovery when breaches occur. They expect this effort to evolve over years and to change as public- and private-sector partners learn what works.
Prior work and next steps
In June, Anthropic launched a cyber defense program for state, local, tribal, and territorial governments. Since then, the company has offered frontier Claude models and technical support to more than half of all US states and some of the country’s largest public critical infrastructure operators, supporting faster code scanning and patching, incident response, red teaming, and other security workflows.
Over the coming months Anthropic plans to expand CIDP to more partners and sectors and to publish lessons learned, including failures. The company expects other AI developers, security firms, and governments to run complementary efforts and expresses willingness to collaborate where it helps defenders.
Anthropic will also broaden its work to secure open source and the wider supply chain, researching new ways to write and defend software and sharing frontier research, tools, and resources to help others secure their software and supply chains.
Organizations that build security products or services for critical infrastructure can register interest in the Critical Infrastructure Defense Program as it scales. Core maintainers of critical open-source projects can enroll in OSS Scanner. Security teams of any size, including operators of critical infrastructure and open-source maintainers, can apply to the expanded Cyber Verification Program for access to Anthropic’s models for defensive purposes.
Summary
The Anthropic Cyber Mission bundles model access, engineering support, research, and funding to help secure operational technology and open-source ecosystems. Its first public components are the Critical Infrastructure Defense Program with eleven founding partners and OSS Scanner, a free opt-in scanner that Anthropic expects will achieve over a 90% true-positive rate; the company also merged Project Glasswing into an expanded Cyber Verification Program and plans ongoing expansion and collaboration.
