Anthropic launched the Anthropic Cyber Mission on October 8, a long-term initiative that puts its frontier models to work on two surfaces that are particularly difficult to secure: the operational technology behind critical infrastructure and open-source software. The announcement combines a program involving industrial-security providers, Anthropic engineers, and threat research with a new free service that will look for vulnerabilities in open-source projects. [1]

The first track is the Critical Infrastructure Defense Program (CIDP). Its initial focus is on the systems that support electric grids, water facilities, factories, and transportation. These environments rely on controllers, industrial networks, and software that may remain in service for decades; they also cannot always be shut down to install a fix. Anthropic acknowledges that an incorrect change can disrupt a plant and that AI by itself cannot solve those operational constraints. [1]

The program brings together Claude models, on-site engineers, and threat research. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. Anthropic says several partners are already working with Claude to fix vulnerabilities and help customers do the same. The company frames the effort as support for established specialists rather than a replacement for the teams responsible for operating these systems. [1]

The second track is OSS Scanner, a free, opt-in service for open-source maintainers. Accepted projects will receive periodic scans using Anthropic’s strongest models. The service builds on Project Glasswing and is intended to cover more than detection: finding flaws, helping verify them, and proposing patches that maintainers can review. [2]

The scale of the earlier work illustrates why human review matters. Anthropic says its models discovered more than 29,000 candidate vulnerabilities across high-impact projects, while its team could manually review only about 6,000. That gap does not mean 29,000 flaws were confirmed. They are system-generated candidates, and Anthropic itself identifies verification, prioritization, and remediation as the bottleneck. [1] [2]

That distinction is central. A model can expand the search dramatically, but an unvalidated finding can consume time, create noise, or lead to a risky change. In critical infrastructure, cybersecurity must also coexist with availability, physical safety, proprietary equipment, and limited maintenance windows. The announced design therefore keeps providers, operators, and maintainers inside the decision process.

Anthropic has also folded Project Glasswing into an expanded Cyber Verification Program, intended to give more defenders access to more capable models. The Cyber Mission adds engineering resources, tools, and funding to that access. The company says it will expand CIDP to additional partners and sectors over the coming months and publish what it learns, including what does not work. [1]

The program’s actual impact still has to be demonstrated. In these announcements, Anthropic did not publish independently validated metrics for vulnerabilities fixed in production, reductions in incidents, or performance against conventional tools. Discovering a weakness is also not enough to reduce risk: it must be reproduced and classified, disclosure must be coordinated, a patch must be created and tested, and the project or operator must ultimately deploy it.

Even with those limitations, the launch is a concrete move from using models to analyze code toward operational programs connected to the people who can remediate findings. The decisive test will not be how many candidates Claude produces, but how many valid flaws are fixed without introducing new risk into systems that cannot afford to fail.

Sources

[1] Read More — Introducing the Anthropic Cyber Mission
[2] Read More — Launching an opt-in vulnerability-finding service for open-source software