Anthropic's Cyber Mission: a free model-run vulnerability scanner for open source, and an infrastructure program with 11 partners

Anthropic launched the Anthropic Cyber Mission on October 8, which it calls a long-term commitment to securing the systems everyone depends on. It starts in two places: open-source software and critical infrastructure.

OSS SCANNER

An opt-in service, modeled on Google's OSS-Fuzz but run by language models instead of fuzzers, that scans enrolled open-source projects for vulnerabilities. Per Anthropic:

- It is free for open-source projects and uses Anthropic's strongest models, Claude Mythos among them. - Core maintainers of eligible projects enroll with a pull request to Anthropic's GitHub repository. Eligibility follows OSS-Fuzz-style criteria (critical impact on infrastructure and user security) and is decided case by case. - Reports are written entirely by the model and sent without human review, so Anthropic warns some will be wrong. Each comes with a reproducer, an explanation and, where available, a candidate patch.

ANTHROPIC'S OWN NUMBERS

These are Anthropic's figures, not an independent audit.

- Over six months its models produced more than 29,000 candidate vulnerabilities. About 6,000 were reviewed by hand, and nearly 5,000 unverified reports went to maintainers who asked for them. - In a validation test, experts reviewed 97 critical and high-severity findings across 48 projects: 85 (88%) met Anthropic's disclosure bar, 11 were real but duplicates, and 1 was a false positive. - wolfSSL found 72 of 74 reports valid, and five became CVEs. - Anthropic says it expects a true-positive rate above 90%.

CRITICAL INFRASTRUCTURE

The new Critical Infrastructure Defense Program brings frontier Claude models, on-site engineers and threat research to firms that protect operational technology. The 11 founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation, starting with a small cohort of providers. Anthropic also says it has offered frontier models to more than half of US states since it launched a cyber program for state and local governments in June.

WHAT ELSE CHANGED

Project Glasswing has been folded into the expanded Cyber Verification Program, which we covered on October 7. Maintainers can also apply to Claude for Open Source for free Claude Max subscriptions.

WHAT WE DO NOT KNOW

How many projects have enrolled, which Mythos version runs the scans, and whether the true-positive rate holds once unreviewed reports go out at scale.