Anthropic launches free AI vulnerability scans for open source and a critical infrastructure program

On October 8, Anthropic announced the Anthropic Cyber Mission, a long-term effort to give defenders tools, research and funding, starting with open source software and critical infrastructure. The company says Project Glasswing showed that finding vulnerabilities has become easy, while verifying, prioritizing and fixing them remains hard.

OSS Scanner is an opt-in service inspired by Google's OSS-Fuzz. Enrolled projects receive periodic free scans from Anthropic's most capable models; each report includes a proof of concept, an explanation and, where available, a suggested fix. The reports are model-generated and sent without human review, which gets them to maintainers faster but means some will contain errors such as wrong severity ratings; Anthropic expects a true-positive rate above 90%. Projects without capacity to handle unreviewed findings will keep receiving human-verified disclosures. Anthropic also funds the Python Software Foundation, Alpha-Omega and OpenSSF, and the Apache Software Foundation.

The Critical Infrastructure Defense Program brings frontier Claude models, on-site engineers and Anthropic's threat research to the providers that secure operational technology for power, water, manufacturing and transport operators, where systems often can't be taken offline to patch. Founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic is starting with this small group and plans to add partners and sectors in the coming months.