The Pulse
Anthropic Launches Cyber Mission for Critical Infrastructure
Anthropic is launching a Cyber Mission that brings Claude models, engineers and threat research to companies securing critical infrastructure. It is also offering free, automated vulnerability scans to participating open-source projects, wi
AI.info Team · Written with AI ·
“As AI continues to advance, it presents an important opportunity to strengthen cybersecurity across critical infrastructure, provided it is applied responsibly, validated rigorously, and deployed with safety and reliability at the forefront.”
Tony Baker, VP, Digital Trust & Chief Product Security Officer, Rockwell Automation
Anthropic launched its Cyber Mission on October 8, 2026, bringing Claude models, company engineers and threat research to organizations that help protect power grids, water systems, transportation networks and government systems. The effort begins with two programs: a Critical Infrastructure Defense Program for operational technology, and a free vulnerability-scanning service for open-source software.
The company says the mission will support defenders with tools, research and resources. Its first infrastructure cohort consists of 11 providers, including Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several partners are already working with Claude to fix vulnerabilities and assist their customers.
Anthropic starts with providers, not utility rollouts
The Critical Infrastructure Defense Program is aimed at security providers, consultants and equipment manufacturers that already work with operators—not a broad deployment of Claude inside utilities. Anthropic says those partners can bring its models, on-site engineering support and threat research to the operational technology that runs industrial processes. Companies that build security products or services for critical infrastructure can register interest as the program expands.
Operational technology includes controllers, control software and industrial networks used by power and water utilities, factories and transportation systems. Many such systems have been built to last for decades and cannot simply be shut down for software updates. Anthropic says proprietary equipment, risky changes and the possibility that a mistake could stop a plant make securing these environments specialized work.
The company’s plan is to work with a small initial group of providers and learn which approaches are practical. It says some partners are already using Claude to address vulnerabilities and help customers do the same, but it does not describe a uniform deployment process or claim that AI can resolve the physical and operational constraints facing infrastructure owners.
OSS Scanner sends findings without human review
Anthropic’s second effort, OSS Scanner, offers enrolled open-source projects periodic security scans from its most capable models at no charge. Each report can include a proof of concept showing how a bug might be exploited, an explanation of the issue and a suggested fix when one is available. The service is opt-in and is intended for maintainers able to review and act on the findings.
The reports go to maintainers without human review. Anthropic warns that some may be inaccurate, including in their severity ratings, and says it expects a true-positive rate above 90% while working to improve both accuracy and fix quality. For projects that cannot handle unreviewed findings, the company says it will continue human-verified disclosures through its coordinated vulnerability disclosure process.
Glasswing exposed the gap between finding and fixing
The new mission follows Project Glasswing, which gave selected organizations access to Anthropic’s advanced models to examine software for weaknesses. In June, Anthropic said the project’s partners had found more than 10,000 high- or critical-severity flaws. The company’s October announcement says the work made vulnerability discovery easier but did not yet reduce cyber risk enough: verification, prioritization and repairs remain difficult, and in Glasswing, months often passed between discovery and a fix.
That delay can be longer for industrial equipment. Anthropic says an operational-technology repair may have to wait until it can be applied safely, and in rare cases that can take decades. Its forecast is that AI will favor cyber defenders within two years, but it also acknowledges that the near-term balance may be different as exploitation gets cheaper while verification and repair still depend on people. The mission’s stated test is practical: fewer exploitable routes into essential systems, and faster recovery when an attack succeeds.
A wider defense effort, with limits still in view
Anthropic says it will expand the infrastructure program to more partners and sectors in the coming months. The Cyber Mission also includes funding for open-source organizations, including the Python Software Foundation, OpenSSF through the Linux Foundation and the Apache Software Foundation. Maintainers of critical projects can apply to OSS Scanner, while infrastructure security providers can register for the defense program.
The launch puts model access alongside engineers, threat research and money for software maintainers, rather than treating scanning as a stand-alone fix. Yet Anthropic’s own account identifies the hard part: finding a weakness is not the same as validating it, patching it and safely deploying that patch in a live industrial system. The initial program starts with 11 providers, and Anthropic says the first cohort will help determine what works.