FUNDING · COMPANIES · #1740
Anthropic launches Cyber Mission with CIDP and OSS Scanner to support defenders
Anthropic announced the Cyber Mission, a long-term effort to help secure critical infrastructure and open-source software by providing frontier Claude models, on-site engineers, threat research, and funding. Initial components include the Critical Infrastructure Defense Program (CIDP), launched with founding partners such as Accenture, Booz Allen, CrowdStrike, Deloitte and others, and OSS Scanner, a free model-powered security scanning service for open-source projects.
KEY POINTS
- Anthropic announced the Cyber Mission, a long-term effort to help secure critical infrastructure and open-source software by providing frontier Claude models, on-site engineers, threat research, and funding.
- Initial components include the Critical Infrastructure Defense Program (CIDP), launched with founding partners such as Accenture, Booz Allen, CrowdStrike, Deloitte and others, and OSS Scanner, a free model-powered security scanning service for open-source projects.
- This matters because a major AI company is deploying its most capable models, engineering talent, and partnerships to accelerate vulnerability discovery and remediation for critical infrastructure and widely used open-source software, shifting AI resources toward defensive cyber operations.
DECISION BRIEF
CONFIDENCE
WHAT CHANGED
Anthropic launched the Anthropic Cyber Mission and announced two initial components: the Critical Infrastructure Defense Program (CIDP) and OSS Scanner. CIDP is described as bringing frontier models, on-site engineers, and threat research to defenders of operational technology. OSS Scanner offers regular, free security scans of open-source projects using Anthropic’s strongest models.
WHY NOW
Anthropic is directing frontier models, engineering talent, threat research, and funding toward defenders of operational technology and open-source software. The company cites lessons from Project Glasswing (many uncovered vulnerabilities but insufficient risk reduction), ongoing resource shortages for defenders, and the dual reality that frontier models both enable faster vulnerability discovery and can be misused for cyber operations.
WHO IS AFFECTED
Directly affected parties include: operators and defenders of operational technology (power grids, water systems, factories, transportation networks) and government systems; maintainers and projects in open-source software that opt into OSS Scanner; defenders who gain access to Anthropic’s most capable models via its Cyber Verification Program.
CONFIRMED
• Anthropic announced the Anthropic Cyber Mission and said it will support defenders with tools, research, resources, engineering talent, and funding. • Anthropic introduced the Critical Infrastructure Defense Program (CIDP), described as bringing frontier models, on-site engineers, and threat research to defenders of operational technology. • Anthropic launched OSS Scanner, offering open-source projects regular security scans from its strongest models at no cost. • The Verge reports OSS Scanner outputs will be fully model-generated, without human review or triage, and includes Anthropic’s Mythos among the models. • Anthropic merged Project Glasswing into an expanded Cyber Verification Program to give more defenders access to its most capable models.
UNCERTAIN
Missing or uncertain details (explicitly not provided in the supplied excerpts): • Scale, timeline, and selection criteria for CIDP on-site deployments (which sites, how many, which partners will host deployments). • Exact operational processes for CIDP (how frontier-model findings will be verified, prioritized, and remediated in OT environments). • Whether OSS Scanner will add human review or triage to its reports in the future; Anthropic’s excerpt does not state review policy and The Verge states current outputs are fully model-generated. • The scope and cadence of OSS Scanner scans (frequency, coverage, how projects opt in, and reporting formats). • How Anthropic will mitigate risks from misuse of frontier models when deploying defensive capabilities. • Quantitative expected impact (number of vulnerabilities found/fixed) and whether the initiative will materially reduce systemic cyber risk—Project Glasswing was said to have uncovered many vulnerabilities but insufficiently reduced risk. Conflicting or partially overlapping evidence: The Anthropic excerpt emphasizes deploying engineering talent and resources; The Verge excerpt emphasizes OSS Scanner’s fully automated, no-human-review reports. There is no explicit Anthropic statement in these excerpts detailing whether human review is used for OSS Scanner, creating a gap.
WHAT TO WATCH
Concrete observable signals to watch next (based on supplied excerpts): • Official Anthropic announcements detailing CIDP operational plans: partner lists, deployment sites, timelines, and on-site engineer roles. • Public metrics or reports on OSS Scanner activity: number of projects scanned, scan cadence, and examples of generated vulnerability reports. • Any change in OSS Scanner policy about human review/triage of reports (e.g., announcements that reports will include human validation). • Evidence of remediation outcomes: projects or OT operators confirming vulnerabilities reported by Anthropic were verified and patched. • Community response from open-source maintainers and major projects (volume of AI-generated reports, complaints or acceptance), given past strains noted for maintainers. • Further publications from Anthropic about tools, research, or expansion of the Cyber Mission (e.g., releases from the Cyber Verification Program or Project Glasswing follow-ups).
WHY IT MATTERS
This matters because a major AI company is deploying its most capable models, engineering talent, and partnerships to accelerate vulnerability discovery and remediation for critical infrastructure and widely used open-source software, shifting AI resources toward defensive cyber operations.
EVIDENCE MAP
4Editorial claims linked to specific sources, with support, contradiction and context shown separately.
Anthropic launched the Cyber Mission as a long-term commitment to helping secure systems.
SUPPORTEDChecked 2026-10-08 · 1 supporting
The Cyber Mission initially focuses on two areas: critical infrastructure and open-source software.
SUPPORTEDChecked 2026-10-08 · 1 supporting
Anthropic introduced the Critical Infrastructure Defense Program (CIDP) to bring frontier models, on-site engineers, and threat research to defenders of operational technology.
SUPPORTEDChecked 2026-10-08 · 1 supporting
Anthropic launched OSS Scanner to offer free, periodic security scans of opt-in open-source projects using its strongest models.
SUPPORTEDChecked 2026-10-08 · 2 supporting
Anthropic: “Today, we’re launching OSS Scanner, which offers open-source projects regular security scans from our strongest models, for free.”
SUPPORTS The Verge AIMEDIA · 2026-10-08The Verge: OSS Scanner “offers vulnerability reports from Anthropic’s ‘strongest models,’ including Mythos,” and open-source projects that opt in will get “thorough, periodic security scans … at no cost.”
SOURCES & TIMELINE
3Today we’re launching the Anthropic Cyber Mission, a long-term commitment to securing the systems everyone depends on. The Cyber Mission is a new effort to support defenders with tools, research, and resources to secure their software and systems. We’re starting with two areas: Critical infrastructure: Starting with securing the operational technology behind power grids, water systems, and transportation networks, an…
The new OSS Scanner service offers vulnerability reports from Anthropic’s “strongest models,” including Mythos. Anthropic’s offering to help open-source projects track down security vulnerabilities with a new service called OSS Scanner . It says open-source projects that opt-in will get “thorough, periodic security scans by our strongest models at no cost.” That could mean open-source projects get alerted about poss…
Anthropic has launched Cyber Mission, a long-term program to protect critical infrastructure and open-source software from cyberattacks. Its Critical Infrastructure Defense Program (CIDP) gives operators of power grids, water systems, and transportation networks access to Claude models, engineers, and threat analysis. CrowdStrike, Palo Alto Networks, Deloitte, and Rockwell Automation are founding partners. Separatel…