Claude on the defenders' side: Anthropic's Cyber Mission, from power grids to open source code

The starting admission in Anthropic's official announcement is blunt: AI models with strong cyber capabilities are now widely available to attackers. That is why, on 8 October 2026, the company unveiled its Cyber Mission, a long-term commitment to put those same technological resources in the hands of the people who have to defend digital systems. The initiative focuses on two specific areas: the operational technology that runs water, power and transport networks, and the open source software that underpins much of the web.

On the physical infrastructure front, the Critical Infrastructure Defense Program (CIDP) will provide frontier Claude models and hands-on engineering support to a first cohort of technology vendors. The founding partners are eleven companies from the sector, including CrowdStrike, Deloitte and Palo Alto Networks; on Anthropic's launch page, Palo Alto Networks senior vice president Sam Rubin stressed that attackers are already using AI to find and exploit vulnerabilities at machine speed. For now, though, Anthropic's documentation does not say what the commercial terms will be once the initial phase is over, or when the program will open beyond the first cohort; in the meantime, other companies in the sector can register their interest through a form.

The second pillar is OSS Scanner, a free, opt-in service inspired by Google's OSS-Fuzz. It periodically scans open source code and sends maintainers reports generated directly by the models, each containing a proof-of-concept exploit, an explanation and, where available, a proposed fix. Anthropic says these reports go out with no prior human review and warns that they may contain inaccuracies, such as a misjudged severity, although it internally expects a true positive rate above 90%. The service is meant for projects able to handle the output: those that cannot triage raw reports will keep receiving human-verified findings through the coordinated disclosure process already in place. How much work it will offload onto participating maintainers remains an open question, echoing the recent debate over Google halting automated submissions to its bug bounty.

The financial and operational framework around all this consists of an expanded Cyber Verification Program, which by folding in Project Glasswing promises security professionals easier access to the models' advanced cyber capabilities, and the Defender Advantage Fund. The fund, launched in August partly to keep OSS Scanner free, has an undisclosed size but already supports the Python Software Foundation, the Apache Software Foundation and, through the Linux Foundation, Alpha-Omega and OpenSSF.

AI may promise to speed up the discovery of weak spots, but the real knot is likely to remain the work of verification. Automating bug reports without a prior check shifts the burden of analysis onto whoever receives them. In free software, where time is the scarcest resource, the tool's real value will be measured by whether that forecast holds: a true positive rate above 90% that, so far, nobody has verified independently. — Olya