THE LAUNCH
On Thursday, October 8, Anthropic announced what it calls a Cyber Mission, a long-term effort to use its models for defense. It has two parts. The first is a Critical Infrastructure Defense Program aimed at the operators and providers that protect operational technology, such as power grids, water systems and transportation networks. The second is OSS Scanner, a free service for open-source projects. Everything below is drawn from secondary coverage and write-ups of the announcement, so treat the details as reported.
THE 11 FOUNDING PARTNERS
The infrastructure program launches with 11 partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. The mix is telling. It combines consultancies that sit inside large enterprises, security vendors, and industrial-control specialists. According to the coverage, trusted providers receive frontier Claude models, on-site engineers and Anthropic's threat research. The aim is to put strong models next to the people who already understand the physical systems.
OSS SCANNER
The more unusual part is OSS Scanner. Anthropic describes it as inspired by Google's OSS-Fuzz. Projects opt in, reportedly by adding a config file and a Dockerfile to the anthropics/oss-scanner repository, and then receive periodic scans from Anthropic's most capable models at no cost. Each report can include a self-contained proof of concept, an explanation with a bisection where possible, and a candidate patch when one is available. It builds on Project Glasswing, in which Anthropic scanned hundreds of widely used open-source projects and privately disclosed findings to maintainers after human review.
NO HUMAN IN THE LOOP
The key difference from Glasswing is that OSS Scanner reports are model-generated and delivered without human review. Anthropic acknowledges that some will contain inaccuracies, such as a wrong severity rating. It expects a true-positive rate above 90%. One summary cites an early result of 85 of 97 findings (88%) meeting the bar for coordinated vulnerability disclosure, with one false positive. That is promising, but the 90% figure is a projection, not a measured result, and the early sample is small.
THE MAINTAINER PROBLEM
Open-source maintainers are often volunteers, and many have already been flooded with low-quality AI-generated bug reports. A free scanner that sends a steady stream of findings can help or can add to the pile, depending on precision. Anthropic seems aware of this. It says the service is meant for projects that can keep up with the findings, and that for others it will continue to share human-verified disclosures under its coordinated vulnerability disclosure policy. Opt-in enrollment and the inclusion of reproducers and patches are meant to reduce the cost of triage.
WHAT IS STILL UNKNOWN
How the measured false-positive rate holds up across thousands of projects. How many maintainers enroll, and how many act on the reports. What the infrastructure program delivers in practice beyond the partner list. And how defenders will keep pace if attackers use similar models without the disclosure rules. The figures above come from secondary reporting, so check Anthropic's own post before citing them.
WHY THIS MATTERS FOR TEAMS BUILDING ON AI
Three practical takeaways. First, vulnerability discovery is getting cheap, which means the backlog of known issues will grow faster than most teams can clear it. Invest in triage, patch pipelines and dependency updates, not only in scanning. Second, a finding with a reproducer and a candidate patch is far easier to trust than a bare alert, so demand that evidence from any AI tool you adopt. Third, if you maintain or depend on open-source code, decide now how you will handle machine-generated reports: who reads them, how fast, and what counts as a fix.