Anthropic has launched the Cyber Mission, a long-term program to put its strongest models in the hands of people who defend software and infrastructure. The first piece is the Critical Infrastructure Defense Program (CIDP), which gives security providers that protect power grids, water systems and transportation networks frontier Claude models, on-site engineers and threat research. The second is OSS Scanner, a free scanning service for open-source projects. Anthropic announced both on October 8, 2026 in its Cyber Mission post.
It ties together Anthropic's earlier cyber programs under one banner. If you only want the short version, the table below answers the questions people are asking first.
Quick answers
| Question | Answer |
|---|---|
| What is it? | A long-term defender-first effort, starting with two programs: CIDP and OSS Scanner |
| Who is in CIDP? | 11 founding partners, from Accenture to Rockwell Automation |
| What do partners get? | Frontier Claude models, on-site engineers, threat research |
| What is protected? | Operational technology (OT) behind grids, water and transport, plus government systems |
| Can I apply? | Security vendors, integrators and equipment makers can register interest on claude.com |
| Is OSS Scanner free? | Yes, opt-in, funded partly by the Defender Advantage Fund |
| What is the main caveat? | OT fixes can take years or decades; OSS Scanner reports are unreviewed model output |
What is the Critical Infrastructure Defense Program?
CIDP is aimed at the companies that sell security to operators, not at the operators themselves. Anthropic says it will provide "frontier Claude models, on-site engineers, and threat research" to the providers that protect operational technology, the control systems and industrial equipment that keep physical infrastructure running. Government systems are in scope too.
The 11 founding partners named in the announcement are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. That mix matters. Dragos and Nozomi Networks are OT-specialist security vendors, Rockwell Automation and Hitachi build industrial equipment, CrowdStrike and Palo Alto Networks are broad security platforms, and Accenture, Booz Allen, Deloitte and PwC are the integrators who deploy this kind of tooling inside large organizations.
Anthropic says several partners are already using Claude to fix vulnerabilities, and that it is starting with a small group to learn which approaches work best before widening the circle. Tony Baker, VP and Chief Product Security Officer at Rockwell Automation, is quoted saying the technology must be "applied responsibly, validated rigorously, and deployed with safety and reliability at the forefront." CrowdStrike's Daniel Bernard puts the stakes this way: "Critical infrastructure is where cyber risk becomes real-world risk." Insane Cyber's Dan Gunter says Claude helps cover the large volume of data across many sites that teams cannot review by hand.
Why a distribution program, not just a model release?
Anthropic's own argument is that capable models are already widely available to attackers, while defensive tooling has not reached enough defenders. It forecasts that AI will favor defenders within two years, but warns that may not hold in the near term. Exploiting vulnerabilities has become cheaper; verifying, disclosing and fixing them is still slow.
That is the real bottleneck in OT. Anthropic says that during Project Glasswing, months often passed between discovery and repair, and that some OT fixes may take decades because they must wait until they can be applied safely to running machinery. A water utility cannot reboot a pump controller the way a SaaS team redeploys a container. So the program pairs models with on-site engineers rather than just API access: someone has to understand the plant before a patch is trusted.
How CIDP fits with Anthropic's earlier cyber programs
Anthropic has been assembling a stack of defender programs through 2026, and the Cyber Mission is the umbrella.
- Project Glasswing started with Claude Mythos Preview, where Anthropic scanned hundreds of widely used open-source projects and humans triaged findings for private disclosure. Anthropic says Glasswing was merged into the expanded Cyber Verification Program earlier this week.
- The Cyber Verification Program offers expanded access to Claude's cyber capabilities for defensive work, and security teams of any size can apply.
- OSS Scanner is the opt-in service, inspired by Google's OSS-Fuzz, that sends enrolled projects periodic scan reports.
- Claude Security is the scan-and-fix product for code.
- In June, Anthropic launched a cyber defense program for state, local, tribal and territorial governments, and says it has since offered Claude and technical support to more than half of US states and some large public critical infrastructure operators.
CIDP is the OT-shaped addition: where Glasswing and OSS Scanner look at code that ships to the world, CIDP looks at the software and firmware inside industrial and public systems.
OSS Scanner: the second leg
OSS Scanner is the part of the announcement open-source maintainers can use today. Enrolled projects receive periodic scans from Anthropic's most capable models. Each report contains a proof of concept showing how a bug could be exploited, an explanation, and a suggested fix where one exists.
Anthropic is candid about the trade-off. Reports are model-generated and sent without human review, so some may contain errors, for example wrong severity ratings. It expects a true-positive rate above 90% and says it plans to improve it. It is meant for projects that can keep up with the volume of findings; other projects still receive human-verified disclosures under Anthropic's coordinated vulnerability disclosure policy.
Funding is part of the story. Anthropic says it funded the Python Software Foundation, Alpha-Omega and OpenSSF (through the Linux Foundation) and the Apache Software Foundation, and supports Akrites and Gold Eagle, which coordinate vulnerability reports so maintainers are not overwhelmed. The Defender Advantage Fund (0xDAF), launched in August, underwrites pilots and keeps OSS Scanner free. Maintainers can also get free Claude Max subscriptions through Claude for Open Source. Our full OSS Scanner guide covers enrollment and the disclosure-clock question.
Who can join what
Anthropic's post sorts the on-ramps by role:
- Critical infrastructure security vendors, integrators and equipment makers: register interest in CIDP through the form on claude.com.
- Core open-source maintainers: enroll in OSS Scanner.
- Security teams of any size: apply to the expanded Cyber Verification Program.
If you run security for an operator rather than sell to one, the realistic route today is through one of the 11 partners, or the Cyber Verification Program.
What we do not know yet
The announcement leaves several things open, and it is worth being clear about them.
- No pricing or contract terms. Anthropic does not say what partners pay, or whether CIDP access is free, discounted or part of existing enterprise deals.
- No results. "Several partners are already using Claude to fix vulnerabilities" is a statement of use, not a count of bugs fixed or time saved.
- Which models. The post says "frontier Claude models" without naming a tier. The company's current lineup is covered in our Fable 5 and Mythos 5 launch post.
- Safety controls for OT. Giving a model to a vendor whose customers run live plants raises obvious questions about guardrails, logging and who may run exploit code against what. Anthropic's own earlier cyber eval incidents are a reminder that these systems can act beyond their brief.
- The dual-use balance. The same capability that finds a flaw in a protocol stack can help exploit it. Anthropic's answer is access tiers and partner vetting; independent evaluation is not part of this announcement.
What this means for people who build and learn
If you work in security, the practical shift is that frontier vulnerability-finding is being packaged for defenders in three forms: free scanning for open source, a verification tier for security teams, and embedded engineers for critical infrastructure. If your employer is one of the 11 founding partners, expect Claude-assisted vulnerability work to show up in OT assessments soon.
If you maintain an open-source project, read the OSS Scanner terms and decide whether you can triage unreviewed reports. The VulnCheck analysis of AI-found bugs and exploit rates is a useful grounding for how many AI-found bugs become real exploits.
If you are comparing vendors, note that Anthropic is not alone: see our look at OpenAI's GPT-5.5 for cyber defenders versus Mythos and the offensive side, Armadin's AI attack swarms, which shows why defenders want the same tools. Anthropic's government work also extends to science: see the $150 million Genesis Mission credits. The partner list also builds on the earlier CrowdStrike Falcon on the Claude Marketplace integration.
The bigger picture
Anthropic's framing is that the window to give defenders an edge is narrow. If its forecast holds, AI favors defenders within two years, but only if the verify-disclose-fix pipeline speeds up as fast as discovery does. CIDP is a bet that the fastest way to shorten that pipeline for critical infrastructure is to embed model access and engineers inside the vendors who already hold the trust of grid and water operators, then publish what works and what fails. Anthropic says it will share lessons, including failures, and expand to more partners, sectors, and work on open-source and supply-chain security.
Whether that happens will show up in disclosed patches, partner case studies and independent evaluations. Until then, treat this as a credible, well-staffed pilot with a strong partner list and few published numbers.
Details are accurate as of October 8, 2026; program terms and partner lists may change as Anthropic expands the Cyber Mission.
Related reading
- Claude Mythos Preview and Project Glasswing
- Anthropic Cyber Verification Program: three tiers
- Anthropic OSS Scanner guide
- Claude Security scan and fix public beta
- CrowdStrike Falcon on the Claude Marketplace
- VulnCheck: AI-found bugs and exploit rates
- Official: Anthropic Cyber Mission announcement
- Official: OSS Scanner launch post