Anthropic launched the Cyber Mission on October 8, 2026, putting its frontier AI models to work on two cybersecurity problems: defending essential infrastructure and finding bugs in critical open-source software. The company is introducing a Critical Infrastructure Defense Program alongside OSS Scanner, an opt-in service that offers eligible maintainers periodic vulnerability reports at no cost. Anthropic says both initiatives build on its Project Glasswing experience. Neither launch establishes that AI-driven vulnerability discovery has already produced a measurable reduction in real-world cyber risk.
Anthropic launches two defense programs
In its official Cyber Mission announcement, Anthropic describes the effort as a long-term commitment to make advanced models, research and engineering resources available to cybersecurity defenders. The two initial programs target very different environments. Operators of electricity, water and transportation infrastructure need tools that can be used without disrupting operational technology. Open-source maintainers need an affordable way to examine large codebases and receive vulnerability reports quickly enough to take action.
The Cyber Mission does not replace the company’s previously announced Project Glasswing. Anthropic says it learned from that project that discovering vulnerabilities is increasingly feasible but confirming their relevance and coordinating fixes still require considerable human work. The new programs are intended to bring those capabilities to more defenders, not to automate away the entire security response process.
Critical Infrastructure Defense Program
The Critical Infrastructure Defense Program, or CIDP, focuses on operational technology underpinning power grids, water systems and transportation networks, as well as government systems. Anthropic plans to bring frontier models, on-site engineers and threat research to organizations charged with protecting those environments. Such support differs from a conventional software product because safe remediation may depend on site-specific equipment, operators and maintenance windows.
Industrial environments often run systems whose availability cannot be interrupted casually. Even when a security flaw is identified, testing and applying a change can take longer than it would on a general-purpose workstation. Anthropic acknowledges that vulnerabilities uncovered through earlier cyber work may remain unpatched for months and, in unusual operational-technology cases, far longer. The critical metric for CIDP is therefore whether defended systems become harder to compromise or recover faster, not simply how many weaknesses a model can identify.
Anthropic says it intends to expand the program to additional organizations and sectors. The October announcement should not be read as evidence that all critical-infrastructure operators already receive the service or that a comprehensive set of vulnerabilities has been eliminated.
How OSS Scanner works and who can enroll
OSS Scanner is a free, opt-in service for qualifying open-source projects. Anthropic says enrolled projects will receive periodic scans using its strongest models. The scanner is designed to help surface potential security problems that volunteer maintainers and small teams may otherwise have insufficient time or resources to find.
Eligible core maintainers apply through the program’s published enrollment process. Anthropic says eligibility broadly follows the significance criteria used by OSS-Fuzz, favoring projects whose compromise could have a material effect on infrastructure and user security. Enrollment is considered case by case, so this is not a promise of free unlimited scanning for every repository.
The reports may contain a proof of concept, an explanation of the identified problem and a suggested fix when one is available. This can make a candidate issue easier to reproduce and prioritize. The important caveat is that **reports delivered through OSS Scanner are generated by models and are not individually reviewed by Anthropic’s human researchers before delivery**. That differs from the company’s coordinated vulnerability disclosure process, under which human-reviewed findings continue to be distributed to projects that need that approach.
False positives, triage and disclosure risks
Model-generated findings can misclassify severity, misunderstand how a project is deployed or suggest a fix with unintended consequences. Anthropic says it expects a true-positive rate above 90% in the opt-in service, but that figure is a company expectation, not an independent result demonstrating performance on every participating codebase. A scanner that produces many alerts can create extra work for projects lacking a dedicated security team.
Maintainers should confirm affected versions, reproduce the reported behavior, evaluate the realistic threat model and review the suggested remediation before merging it. Proof-of-concept code should also be handled carefully under each project’s security disclosure practices, especially for issues that might enable active exploitation. Anthropic emphasizes that OSS Scanner is aimed at projects capable of keeping up with a faster flow of reports.
Researchers and maintainers can also use other defensive support described in the announcement, including Anthropic’s Cyber Verification Program and Claude for Open Source. Those are related resources, not evidence that OSS Scanner reports have already passed external independent review.
What the Cyber Mission could change
The launch underscores a shift in how major AI laboratories frame cybersecurity work. Stronger models may lower the cost of identifying software flaws, while defenders still face the operationally difficult tasks of verification, patch testing and deployment. Anthropic’s proposals address that bottleneck with a combination of models, human engineering support and focused program eligibility.
Success will require outcomes beyond counts of generated findings: fewer exploitable weaknesses left open, higher-quality disclosures, manageable maintainer workloads and reliable operation of essential services. Anthropic says it will publish lessons as the effort expands, including results that do not work as expected. Until those results are available, the Cyber Mission is a substantive defensive initiative with important implementation and validation questions rather than proof that AI has reversed the cybersecurity balance.
