Anthropic Cyber Mission: CIDP and Free OSS Scanner

Introduction

On October 8, 2026, Anthropic announced the Anthropic Cyber Mission, which it describes as a long-term commitment to securing the systems everyone depends on. It starts with two efforts: the Critical Infrastructure Defense Program (CIDP), aimed at the operational technology behind power grids, water systems and transportation networks, and OSS Scanner, a free service that gives open-source projects periodic security scans from Anthropic's strongest models.

Anthropic says the effort is built on lessons from Project Glasswing, where partners found many vulnerabilities but, in its words, "we haven't yet achieved a sufficient reduction in cyber risk." Finding bugs has become easier; verifying, prioritizing and fixing them has not. Earlier in the same week, Anthropic merged Project Glasswing into an expanded Cyber Verification Program that gives more defenders access to its most capable models.

Critical Infrastructure Defense Program

Operational technology (OT) covers controllers, control software and industrial networks built to last for decades. Anthropic notes these systems often cannot be taken offline to patch, so known vulnerabilities can remain unresolved for years, and that operators rely on a small set of trusted providers. CIDP brings frontier Claude models, on-site engineers and threat research to those providers.

The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several partners are already working with Claude to fix vulnerabilities and help customers do the same, and that the first step is a small cohort to learn which strategies are effective and practical. It also states plainly that critical infrastructure is hard to defend in many ways AI cannot fix. Companies that build security products or services for critical infrastructure can register interest as the program expands.

Anthropic adds that since June it has offered frontier Claude models and technical support to more than half of all US states and some of the country's largest public critical infrastructure operators, through a separate program for state, local, tribal and territorial governments.

OSS Scanner

OSS Scanner is an opt-in service inspired by Google's OSS-Fuzz. Enrolled projects receive periodic scans from Anthropic's most capable models, including Claude Mythos according to the research post, at no cost. Each report includes a proof of concept or reproducer, an explanation (with a bisection to find when the bug was introduced, where possible), and a suggested fix where one is available.

The key design choice is that reports are model-generated and sent without human review. Anthropic says this gets reports to maintainers faster but means some will contain inaccuracies, such as a wrong severity rating. The background: over six months Anthropic discovered over 29,000 candidate vulnerabilities but manually reviewed and triaged approximately 6,000, and has sent nearly 5,000 reports directly to maintainers who asked for everything, validated or not.

Maintainers enroll by submitting a pull request to a designated GitHub repository following a project template. Eligibility is based on criteria similar to OSS-Fuzz, such as a "critical impact on infrastructure and user security," and decisions are case by case. Human-verified disclosures under Anthropic's coordinated vulnerability disclosure (CVD) process continue for projects without capacity to triage reports themselves.

Two different accuracy figures

Two numbers appear in the materials and they measure different things.

Of the remaining 12 in that check, 11 were real but duplicated known issues or other findings from the scan, and one was an invalid false positive. Anthropic adds that some maintainers have said severity ratings can be inflated or that the scanner misunderstood a project's threat model. The sample is Anthropic's own validation of high and critical findings, so it should not be read as a measured rate for every report the service will send.

Maintainer feedback quoted by Anthropic is positive. wolfSSL reported that of 74 reports received, all but two were valid and five became CVEs. curl's Daniel Stenberg said the scanner helped find multiple issues, including one of the worst curl vulnerabilities reported in the last few years. These are early-testing quotes selected by the vendor.

Practical considerations

For open-source maintainers, the value depends on triage capacity. Unreviewed reports arrive faster, but each one still needs a human to confirm and prioritize. Anthropic says as much: the service is meant for projects with the capacity to keep up with surfaced findings. Small teams may be better served by the human-verified CVD route.

For OT security providers, CIDP is a partner program rather than a product that operators buy directly. Its stated aim is to speed up finding and repairing weaknesses, but patching running machinery remains constrained; Anthropic notes that in rare cases a fix might wait decades until it can be applied safely.

Outlook

Anthropic's forecast is that in two years AI will favor defense, making it easier to catch bugs before they ship and to write secure software from scratch. It cautions that in the near term this may not hold, because the cost of exploiting vulnerabilities has dropped while verifying, disclosing and fixing them still depends on people. It says it will expand CIDP to more partners and sectors, share what it learns including what did not work, and fund open-source organizations and pilot programs, with the Defender Advantage Fund keeping OSS Scanner free.

Conclusion

The Cyber Mission is a credible response to a real bottleneck: discovery has outpaced remediation. Its limits are equally clear in Anthropic's own text. Unreviewed model output shifts verification work onto maintainers, and the program impact on OT risk is, for now, a small cohort of partners learning what works. Security vendors, OT providers and maintainers of critical open-source projects are the audiences who should evaluate it. Rating: 4 out of 5.

Editor's Verdict

Anthropic Cyber Mission: CIDP and Free OSS Scanner earns a solid recommendation within the Claude space.

The strongest case for paying attention: free scanning removes a cost barrier for resource-constrained open-source maintainers. That alone raises the bar for what readers should expect in this space. Reinforcing that, reports include reproducers and candidate patches, which makes verification faster — practical value rather than just headline appeal. The broader signal worth registering is straightforward: the program targets the verify-prioritize-fix bottleneck, not discovery, which Anthropic says is now easier than ever. On the other side of the ledger, one constraint is real rather than a marketing footnote: reports are model-generated without human review, so some will contain inaccuracies such as wrong severity ratings. It should factor into any serious decision. Layered on top of that, the quoted accuracy figures come from Anthropic's own validation and maintainer quotes it selected — which narrows the set of teams for whom this is an obvious yes.

For core maintainers of critical open-source projects with the capacity to triage findings, OSS Scanner is a serious candidate to enroll in, and OT security providers should watch how the CIDP cohort expands. For smaller projects without triage capacity, Anthropic's human-verified disclosure path remains the safer route.