Anthropic launches Cyber Mission with free OSS Scanner security scans

Anthropic announced the Anthropic Cyber Mission on October 8, 2026, a long-term effort to secure the systems the public relies on. The effort begins with two programs: a Critical Infrastructure Defense Program backed by 11 founding partners, and OSS Scanner, a free opt-in service that runs regular security scans of open-source software with the company's strongest models, including Claude Mythos.theregister.com+1

The mission matters because Anthropic said frontier models can be misused to exploit vulnerabilities and conduct cyber operations, and state-sponsored adversaries have spent years establishing footholds across many sectors. Defenders of critical infrastructure and the open-source community have decades of security experience but face severe resource shortages, Anthropic said, and the Cyber Mission will deploy engineering talent, tools, and funding to support them.unite.ai

Two programs under one mission

The Critical Infrastructure Defense Program delivers frontier Claude models, on-site engineers, and Anthropic's threat research to the trusted providers that defend operational technology, starting with the systems behind power grids, water systems, and transportation networks, alongside government systems. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.

Power grids, water utilities, factories, and transportation networks run on controllers and industrial networks built to last for decades, and they often cannot be taken offline to patch, so known vulnerabilities can remain unpatched for years. Anthropic called this specialised work, noting the equipment is proprietary, changes carry risk, and a single mistake can take down a plant, leaving operators reliant on a small set of trusted providers.

CrowdStrike said that "critical infrastructure facing machine-speed threats requires machine-speed defense," and Palo Alto Networks said it is pairing its Unit 42 threat intelligence with Anthropic's frontier models to help operators defend essential services. Booz Allen called operational technology the next frontier for autonomous AI-enabled attacks. Anthropic's first step is to work with a small cohort of providers to learn which strategies are most effective.

How accurate the scanner is

OSS Scanner is an opt-in service inspired by Google's OSS-Fuzz that gives enrolled open-source projects periodic scans from Anthropic's most capable models at no cost. Anthropic borrowed Google's eligibility criteria, so it will work on established projects that have a critical impact on infrastructure and user security, not every public repository. Each report contains a self-contained reproducer or proof of concept, an explanation with a bisection where possible, and a candidate patch when one is available.cryptobriefing.com

The reports are fully model-generated and sent without human review, which Anthropic said enables faster delivery but means some will contain inaccuracies such as a wrong severity rating; the company expects a true-positive rate above 90%. To validate an early version, Anthropic asked expert penetration testers to check 97 critical and high-severity findings across 48 projects: 85 (88%) met the bar for its disclosure process, 11 were real but duplicated known issues, and one was a false positive.

Over six months, Anthropic said, its models flagged more than 29,000 candidate vulnerabilities, roughly 6,000 of which were manually reviewed and triaged, while nearly 5,000 unverified reports went directly to maintainers who asked to receive everything. Anthropic also said large language models now find more than 85% of vulnerabilities, up from 20% at the start of 2025, and that automated AI bug reports were considered mostly slop at the beginning of the year but are now considered high-quality.

What maintainers report so far

Maintainers quoted in Anthropic's post reported strong results. Todd Ouska of wolfSSL said that "of the 74 reports we received, all but two were valid, and five became CVEs." PostgreSQL's Noah Misch said an unusually high fraction of findings uncovered PostgreSQL defects and several reports came with fixes his team could use nearly as-is. OpenSSL Corporation's Anton Arapov said the reports were as good as or better than what it gets from people.

Anthropic said the program extends its government-sector work. In June, the company launched a cyber defense program for state, local, tribal, and territorial governments, and said it has since offered frontier Claude models and technical support to more than half of all US states and some of the country's largest public critical infrastructure operators, accelerating code scanning, patching, incident response, and red teaming.

Anthropic predicts that in two years, defenders will have the advantage because AI will catch bugs before they ship, but until then attackers have the upper hand. Anthropic said in a blog post that "Defenders of critical infrastructure and the OSS community have decades of security experience but have faced severe resource shortages that are exacerbated by this moment."

Companies that build security products or services for critical infrastructure can register interest as the Critical Infrastructure Defense Program expands, and eligible open-source projects can opt in to OSS Scanner. Anthropic said it believes frontier models can help find and repair weaknesses before they are used to cut off power or make water unsafe, while acknowledging critical infrastructure is hard to defend in many ways AI cannot fix.