Anthropic's Cyber Mission starts with a defender program for industrial systems and an unreviewed scanner for open source

On October 8, 2026, Anthropic announced the Anthropic Cyber Mission, which it calls a long-term commitment to helping defenders secure software and systems. It opens with two programs: one for the providers that protect critical infrastructure, and one that sends free, model-generated vulnerability scans to open-source projects.

The Critical Infrastructure Defense Program supplies Claude models, on-site engineers and threat research to companies that secure operational technology, the controllers and software behind power, water and transport. Anthropic names eleven founding partners, including Accenture, CrowdStrike, Dragos and Rockwell Automation. It says several are already using Claude to fix vulnerabilities, and that it will begin with a small group to learn what works. It also acknowledges that such systems often cannot be taken offline to patch. SiliconANGLE notes that the announcement leaves out commercial terms, and relays Axios's question of how partners will deploy fixes without disrupting utilities.

OSS Scanner is the second piece. Enrolled projects get periodic scans from Anthropic's strongest models at no cost, with a reproducer, an explanation and a candidate patch where one exists. Anthropic stresses that reports are not reviewed by humans, so some will be wrong or overrate severity. The company expects a true-positive rate above 90%, which is a forecast rather than a measured result.

Anthropic's own numbers show why it chose this design. It says its models produced over 29,000 candidate vulnerabilities in six months, of which about 6,000 were manually triaged, and that it has already sent nearly 5,000 unvalidated reports to maintainers who asked for them. In a test of an early version, its penetration testers found 85 of 97 critical and high findings, across 48 projects, met the company's disclosure standard. Eleven of the rest were real duplicates and one was invalid. Maintainers enroll with a pull request to a GitHub repository, and eligibility is decided case by case. SiliconANGLE reports that the Defender Advantage Fund keeps the service free.

What remains unclear is how well this works at scale. The accuracy figures come from Anthropic's reviewers, not an outside audit, and no results from the infrastructure program have been published. SiliconANGLE's coverage rests largely on Anthropic's announcement, so independent verification of the claims is limited.

It matters because finding bugs is getting cheaper while verifying and fixing them still depends on people. Anthropic itself says months often passed between discovery and a fix. Handing maintainers raw findings shifts that burden to them, which suits well-staffed projects better than small ones.

Revised 16 October 2026: Guth re-read the original sources and rewrote this article. Correction: the earlier version said maintainers enroll by submitting a pull request to the project template repository, and described the 97-finding check as a separate evaluation. The source says the pull request goes to a GitHub repository following the standard project template, and that the check was of an early version of the scanner. The earlier version remains available as revision 1.