Anthropic Cyber Mission targets the gap between finding vulnerabilities and fixing them

Anthropic has launched a Cyber Mission combining work on critical infrastructure and open-source software. The company describes a longer-term commitment of models, engineering support, research and resources, while acknowledging that finding vulnerabilities has not yet produced a sufficient reduction in cyber risk.

The Cyber Mission announcement introduces the Critical Infrastructure Defense Program and OSS Scanner as its initial efforts. Its broader argument is about the work after discovery: verifying findings, deciding which matter and applying fixes safely. That is distinct from a claim that more model-generated bug reports automatically make systems secure.

Infrastructure defense starts with providers operators already use

Anthropic's Critical Infrastructure Defense Program supplies frontier Claude models, on-site engineers and threat research to providers serving industrial operators. Its founding partners include equipment makers, security companies and consulting organizations with experience in operational technology.

The announcement names Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several partners already work with Claude to identify and fix vulnerabilities. It does not provide a complete inventory of implementations or independently assessed outcomes for those partners.

Operational technology includes controllers, control software and industrial networks behind power, water, manufacturing and transport. Anthropic emphasizes that these systems often cannot be taken offline to patch and that changes can carry physical and operational risks. The programme begins with a small cohort to learn which approaches are practical.

The company also describes earlier assistance to state, local, tribal and territorial governments, saying it has offered models and technical support to more than half of US states. That is Anthropic's account of its reach, not an audited measure of reduced incidents across those jurisdictions.

Faster disclosure does not finish the remediation work

For open-source software, OSS Scanner offers free periodic scans to enrolled projects. Reports include an explanation, a proof of concept and a proposed fix where available. Anthropic says the reports are model-generated and arrive without human review.

The service responds to maintainers who asked to receive all model findings rather than wait for manual triage. That route can increase the speed and volume of incoming reports, but also leaves maintainers responsible for checking inaccuracies such as a wrong severity rating. Anthropic keeps human-verified coordinated disclosure for projects that need that support.

The Cyber Mission's proposed next steps include faster delivery of findings, assistance with triage and patching, and research into stronger software architectures. The company says it will work with maintainers and foundations rather than impose one workflow on every project.

It also describes funding organizations behind widely used code and supporting groups that coordinate reports from multiple sources. Those commitments address the organizational burden of handling findings. They do not establish that automatic patching or a particular secure architecture has already solved that burden.

Anthropic's defense forecast remains a forecast

Anthropic predicts that AI will favor defense in two years, while cautioning that the near-term balance may be different. It says exploitation has become cheaper while verification, disclosure and fixes remain slow and dependent on people.

The announcement recounts months between finding and fixing vulnerabilities during Glasswing. For operational technology, Anthropic says a safe opportunity to apply a change may take much longer. Those delays explain why capability to discover a weakness and capability to remove it need separate evaluation.

Success, in the company's account, means essential services continue operating under attack, with fewer exploitable paths and faster recovery. It expects years of work and promises to share lessons, including unsuccessful approaches. The useful evidence to look for next is documented remediation and operational results, rather than treating the launch of a mission as proof that the forecast has already come true.