Anthropic launches Cyber Mission with infrastructure defense program and free open-source vulnerability scanner

Anthropic announced Cyber Mission, a long-term cybersecurity programme with two parts. The Critical Infrastructure Defense Program gives operators of power grids, water systems and transport networks access to Claude models, Anthropic engineers and threat analysis, with CrowdStrike, Palo Alto Networks, Deloitte and Rockwell Automation as founding partners. The second part is a free AI scanner that regularly checks open-source projects, flags and explains vulnerabilities and suggests patches. Maintainers of projects critical to infrastructure or user safety can opt in via GitHub, and the reports ship without human review. No dates, participant numbers or programme terms were given.

Volunteer maintainers of widely used open-source code get a free source of vulnerability reports and patch suggestions, which could help if the findings are good. Infrastructure operators get a route to Anthropic's models and staff, but eligibility, cost and scope are unstated, so it is hard to judge who benefits. Because reports are not reviewed by humans, maintainers may face extra triage work from false positives, and that could undercut the benefit for small teams. The partner names suggest commercial distribution through security vendors as much as charity, which matters to competitors in AI security tooling.

The 'above 90 percent accuracy' figure is Anthropic's expectation, not a measured result, and it does not say what is being measured (for example, whether it counts exploitable bugs or any flagged issue). The 'Cyber Mission' branding and the line that attackers have better AI than defenders are framing, not evidence. The coverage is a short write-up with no primary links, so CIDP's terms and the scanner's scale are unverified.

1. 01Published scanner results: number of projects enrolled, vulnerabilities reported, share confirmed by maintainers, and false positive rates, ideally from independent maintainers within the first 3 to 6 months.
2. 02Maintainer reaction on GitHub and security mailing lists, especially complaints about low-quality or unreviewed reports, or projects opting out, as happened with earlier AI-generated bug report floods.
3. 03Concrete CIDP details: how many infrastructure operators join, what the access terms and costs are, whether any named partner announces a deployment, and any regulator or government agency involvement.