Anthropic Cyber Mission

Anthropic has launched the Anthropic Cyber Mission, a long-term commitment to provide defenders of critical infrastructure and open-source software (OSS) with the tools, research, and resources necessary to secure their systems. The initiative aims to address the resource shortages facing defenders while countering the increasing use of AI by state-sponsored adversaries to exploit vulnerabilities.

Critical Infrastructure Defense Program (CIDP)

Anthropic is introducing the Critical Infrastructure Defense Program (CIDP) to protect operational technology (OT)—the controllers, control software, and industrial networks that power grids, water systems, and transportation networks. Because OT systems often cannot be taken offline for patching and rely on proprietary equipment, they are uniquely vulnerable to long-term exploits.

The CIDP provides frontier Claude models, on-site engineers, and threat research to a cohort of trusted security providers. Founding partners include:

  • Consulting and Technology Firms: Accenture, Booz Allen, Deloitte, PwC.
  • Security Companies: CrowdStrike, Dragos, Insane Cyber, Nozomi Networks, Palo Alto Networks.
  • Industrial Manufacturers: Hitachi, Rockwell Automation.

These partners use Claude to identify and repair weaknesses in industrial environments before they can be exploited to disrupt essential services. This program builds upon a previous cyber defense program launched in June for state, local, tribal, and territorial governments, which has already provided support to over half of all US states.

Securing Open-Source Software

To harden the shared code that most modern software depends on, Anthropic is launching OSS Scanner, an opt-in service that provides free, periodic security scans of open-source projects using frontier models.

OSS Scanner Capabilities

  • Automated Reporting: Projects receive model-generated reports including a proof of concept for exploitation, an explanation of the bug, and a suggested fix.
  • Performance: Anthropic expects a true-positive rate above 90%, though reports are sent without human review and may contain inaccuracies in severity ratings.
  • Target Audience: The service is designed for projects with the capacity to triage findings at scale. Projects without this capacity will continue to receive human-verified disclosures via Anthropic's coordinated vulnerability disclosure (CVD) process.

Long-term OSS Goals

Anthropic intends to accelerate the transition from manual triage to automated patching and research new secure architectures and coding practices to move beyond simple patching. To support this ecosystem, Anthropic has funded organizations including the Python Software Foundation, Apache Software Foundation, and the Linux Foundation (via Alpha-Omega and OpenSSF), as well as vulnerability coordinators Akrites and Gold Eagle.

Strategic Context and the "Defender's Advantage"

Anthropic's initiative is driven by the fact that while AI has lowered the cost of exploiting vulnerabilities, the process of verifying and fixing them remains slow and human-dependent. Lessons from Project Glasswing showed that months often pass between the discovery of a vulnerability and its resolution.

Anthropic forecasts that in two years, AI will favor the defense, making it easier to catch bugs before shipping and to write fundamentally secure software. In the interim, the Cyber Mission seeks to close the gap between machine-speed attacks and human-speed defense.

Access and Participation

Anthropic is offering several pathways for security professionals to engage with their tools:

  • Critical Infrastructure Providers: Security vendors and equipment manufacturers can register for the CIDP.
  • OSS Maintainers: Core maintainers can enroll in OSS Scanner.
  • Security Teams: Operators and maintainers can apply to the Cyber Verification Program for expanded access to Claude's cyber capabilities and reduced blocking classifiers.

Sources