Introducing the Anthropic Cyber Mission
C · Weak signal Vendor programme announcement with partner quotes and one forward-looking accuracy claim, no measured outcomes.
Summary based on the full text·Original: about 9 minutes to read
In short
Anthropic announced the Anthropic Cyber Mission on 8 October 2026, a long-term programme to support defenders. It starts with two efforts: the Critical Infrastructure Defense Program, which gives security providers for power, water and transport systems access to frontier Claude models, on-site engineers and threat research; and OSS Scanner, a free opt-in service that sends open-source projects regular model-generated vulnerability reports. The company argues defence currently lags because finding bugs got cheap while fixing them did not.
Key numbers
- 11founding partners of the Critical Infrastructure Defense Program
- >90%expected true-positive rate of unreviewed OSS Scanner reports (vendor expectation)
- more than halfof US states offered frontier models and support since the June government cyber programme
- two yearsAnthropic's forecast horizon for AI to favour defence over attack
As reported by the source.
English·Web page·opens anthropic.com
What it reports
- Founding infrastructure partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
- Project Glasswing, which scanned hundreds of widely used open-source projects with human triage, has been merged into an expanded Cyber Verification Program.
- OSS Scanner reports include a proof of concept, an explanation and a suggested fix, sent without human review; Anthropic expects a true-positive rate above 90% and warns of errors such as wrong severity.
- The service targets projects with capacity to handle findings; others keep receiving human-verified disclosures.
- Funding has gone to the Python Software Foundation, Alpha-Omega and OpenSSF, and the Apache Software Foundation; the Defender Advantage Fund, launched in August, keeps OSS Scanner free.
- Glasswing often saw months between finding and fixing a vulnerability; for operational technology a fix may wait years, in rare cases decades.
- Forecast: in two years AI will favour defence, but not necessarily in the near term.
How they got it
This is a programme announcement. Figures come from Anthropic's own experience with Project Glasswing and its June programme for US state and local governments; no evaluation data are published in the post.
Limits
- The 90% true-positive rate is an expectation, not a measured result.
- Partner quotes are promotional; no outcome metrics for patched vulnerabilities or prevented incidents.
Why it matters for companies
Any company running plants, logistics or building systems depends on operational technology that cannot easily be patched. The bottleneck named here, verifying and fixing findings rather than finding them, applies to internal security teams too: AI scanners will raise the volume of reported issues faster than teams can triage. Firms relying on open-source components should expect more disclosures and plan patching capacity. Ask security providers how they will use these models and who reviews the output.
Summary based on the full text. Read the original for the full argument and data.Read the original on anthropic.com