Anthropic launches Cyber Mission and free OSS vulnerability scanner

Anthropic announced its Cyber Mission on Oct 8, 2026, describing it as a long-term effort to help secure systems people rely on. The company says the initiative will provide defenders with tools, research and other resources to protect software and systems. Its first focus areas are critical infrastructure, including operational technology used in power, water and transportation, and open-source software. The announcement includes both a program for infrastructure providers and OSS Scanner, a service for open-source projects.

The Critical Infrastructure Defense Program is designed to bring Claude models, on-site engineers and threat research to providers that support infrastructure operators. Anthropic says these systems often cannot be taken offline for patching, which can leave known weaknesses unresolved. The work is already underway with several partners, according to the company, which says they are using Claude to address vulnerabilities and help customers do so. Anthropic says it will begin with a small group of providers to learn which approaches work in practice. The program focuses on systems where equipment and operational changes can pose particular security challenges.

OSS Scanner is an opt-in service offering participating open-source projects periodic scans by Anthropic’s strongest models at no cost. Its findings are generated by models and delivered without human review or triage, a design Anthropic says allows scanning to happen more quickly and often. The company also warns that reports may be incorrect or invalid, and that severity assessments can be overstated or miss a project’s threat model. Reports can include a way to reproduce a suspected issue, an explanation and a proposed patch when one is available. For maintainers, the service therefore offers recurring scans but does not provide human validation before reports arrive. Core maintainers of eligible projects can enroll by submitting a pull request to the project template repository.

Anthropic says its recent scanning work found more than 29,000 candidate vulnerabilities, while the company manually reviewed and triaged about 6,000, citing limited human capacity as a constraint. In a separate evaluation, penetration testers reviewed 97 critical- and high-severity findings across 48 projects. Anthropic reports that 85 findings, or 88%, met its coordinated disclosure standard. Of the other 12, the company says 11 were real but duplicates or overlapping findings, while one was invalid. Anthropic says it will continue refining the scanner based on maintainer feedback and cautions that it cannot guarantee perfect results.