Anthropic launches its Cyber Mission with a Critical Infrastructure Defense Program and an opt-in OSS Scanner offering free periodic security scans to open-source maintainers. Scanner reports are model-generated and sent without human review; Anthropic continues human-verified disclosure for projects unable to absorb that volume. The announcement describes efforts and expected performance rather than an independently measured reduction in security risk.
Why it matters
It makes triage capacity and the route from a finding to a safe fix explicit constraints on expanding defensive access.
Key facts
As stated in the sources, with where to find them.
- The Critical Infrastructure Defense Program brings Claude models, on-site engineers and threat research to providers protecting operational technology. Anthropic describes a founding partner cohort and ongoing work, rather than quantified security outcomes.Defending critical infrastructure
- OSS Scanner is opt-in and free. Enrolled projects receive periodic model-generated reports including supporting evidence, an explanation and a suggested fix where available, without human review. Anthropic expects a true-positive rate above 90%; this is an expectation, not a published independent measurement. Anthropic warns that reports can contain errors, including wrong severity ratings.Securing open-source software
- The service is intended for projects able to keep up with findings. Anthropic says it will continue human-verified coordinated disclosure for other projects and notes that verification, prioritization and patching remain slow. Its Glasswing account says it often saw months between discovery and repair; this is a narrative statement, not a measured patch-time average.Securing open-source software; Why we’re doing this
Findings that cite this record
Key questions this bears on
- Is AI shifting the balance between finding and fixing vulnerabilities?Discovery is ahead. Verification, triage, coordinated disclosure and safe repair remain bottlenecks between AI findings and deployed fixes.
Sources
Related records
Oct 12, 2026
Sep 28, 2026
Aug 8, 2025
May 22, 2026
Aug 9, 2023
Feb 20, 2026