On October 08, Anthropic officially announced Cyber Mission, a cybersecurity defense initiative focused on critical infrastructure and open-source software. Its first two components are an infrastructure defense program with 11 founding partners and OSS Scanner, a free vulnerability scanning service for projects that voluntarily opt in.

The company acknowledges that AI’s ability to discover vulnerabilities is advancing faster than humans’ ability to verify, prioritize, and patch them. Therefore, the goal goes beyond simply generating more lists of flaws.

Protecting Systems That Cannot Go Offline

The Critical Infrastructure Defense Program provides advanced Claude models, on-site engineers, and threat research to defenders of power, water, manufacturing, and transportation systems.

The partner group includes Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. They represent consulting firms, cybersecurity vendors, and industrial equipment manufacturers that operators rely on.

According to Anthropic, these systems are often designed to run for decades. Taking them offline for patching may not be feasible, and reckless changes risk shutting down an entire plant. This is why the company chose to partner with entities possessing frontline field experience, rather than merely granting model access.

Some partners have already used Claude to find and remediate vulnerabilities. However, the announcement does not provide independent figures demonstrating how many incidents the program has reduced across critical infrastructure.

OSS Scanner Is Faster, but Shifts Verification to Maintainers

Projects enrolled in OSS Scanner will receive free periodic scans. Reports include proof-of-concept exploits, explanations, and suggested patches when available.

Crucially, reports are delivered without human review. Anthropic warns that they may contain inaccuracies, such as misjudging severity. A true-positive rate above 90% is the company’s expectation, not an independently verified result in the announcement.

This service is intended for teams equipped to handle an influx of new findings. For other projects, Anthropic stated it will continue submitting human-verified findings through coordinated vulnerability disclosure processes.

Finding Flaws Does Not Mean Systems Are Secure

Cyber Mission follows Project Glasswing. Anthropic noted that in the previous initiative, it sometimes took months between discovering a vulnerability and completing a fix. For operational industrial equipment, that gap can be even wider because patches must be applied safely.

The company predicts that AI will give defenders an advantage over the next two years. That remains a forecast. The critical metric to track is how quickly vulnerabilities are verified and fixed, not just how many new issues the model discovers.