Anthropic launches Cyber Mission: free AI bug scans for open source and help for power and water systems

Anthropic is putting its strongest AI models to work on two of the weakest spots in modern security: the aging control systems that run power grids and water plants, and the open-source code that almost every app depends on. The company calls the effort the Anthropic Cyber Mission and describes it as a long-term commitment rather than a one-off project.

The reasoning is blunt. Anthropic says highly capable AI models are already in the hands of attackers, while defensive tools "have not yet reached enough of the defenders who need them." Finding bugs has never been cheaper. Fixing them is still slow, manual work.

Who is in the Critical Infrastructure Defense Program?

The first half of the mission targets what engineers call operational technology: the controllers and industrial networks inside substations, factories, water utilities and transport systems. These machines are built to run for decades and often can't be switched off for a patch, so known holes can stay open for years.

Rather than sell directly to every utility, Anthropic is working through the companies those operators already trust. The Critical Infrastructure Defense Program gives them Claude models, Anthropic engineers on site and the company's threat research. The founding partners are:

Anthropic says several partners are already using Claude to fix vulnerabilities for customers. It also admits the limits: critical infrastructure "is hard to defend in many ways that AI cannot fix."

What OSS Scanner does

The second half is aimed at open-source maintainers, many of them small volunteer teams. Under an earlier effort called Project Glasswing, Anthropic scanned hundreds of widely used projects and reported bugs privately. Some maintainers then asked for everything the models found, reviewed or not.

OSS Scanner is the answer to that request. It is free and opt-in, and was inspired by Google's OSS-Fuzz. Enrolled projects get regular scans, and each report includes:

1. a proof of concept showing how the bug could be exploited,
2. an explanation of the problem,
3. a suggested fix where one exists.

There is a trade-off. The reports are generated by the model and sent without human review, so they arrive faster but some will be wrong, for example with an inflated severity rating. Anthropic says it expects a true-positive rate above 90%. Projects that can't handle a stream of automated findings will keep getting human-checked reports instead.

Why it matters

Anthropic's own forecast is that within about two years AI will favor defenders, making it easier to catch bugs before they ship. In the meantime, it warns, the balance may tip the other way. In Glasswing, months often passed between finding a vulnerability and fixing it, and on industrial equipment a fix can wait far longer.

The company also funds groups that maintain shared code, including the Python Software Foundation, the Apache Software Foundation and OpenSSF, and says maintainers can apply for free Claude Max subscriptions. For a related shift in how AI agents work with software, see our explainer on MCP and Agent Skills.

What it means for you

• If you maintain an open-source project, you can enroll in OSS Scanner, but plan time to triage reports that a human hasn't checked.
• If you work in utilities or manufacturing, expect your security vendor to start offering AI-assisted reviews of control systems.

Sources

• Introducing the Anthropic Cyber Mission (Anthropic)