Anthropic enters the cybersecurity fight to protect power grids and open source

Language models are breaking vulnerability records, but defenders are drowning.

Over the past six months, Anthropic used its frontier models to scan critical software and found over 29,000 candidate vulnerabilities. The catch? Their security staff could only manually verify about 6,000 of them. Meanwhile, attackers need only minutes to spin up working exploits with AI.

To bridge that dangerous gap, Anthropic just launched the Anthropic Cyber Mission, rolling out two major defensive programs: the Critical Infrastructure Defense Program (CIDP) and a free AI audit tool called OSS Scanner.

Defending systems that cannot go offline

AI's ability to hunt bugs has spiked. On the CyberGym vulnerability benchmark, large language models went from catching under 20% of bugs early last year to over 85% this year.

Spotting bugs in enterprise software is one thing; fixing them in critical infrastructure is another. Power grids, water utilities, and factories rely on operational technology (OT) built to run for decades. Taking a system offline to patch a bug can literally shut down a city, leaving known flaws unpatched for years—or even decades.

Through CIDP, Anthropic is deploying frontier Claude models, threat research, and on-site engineers directly to trusted infrastructure defenders. Founding partners include CrowdStrike, Palo Alto Networks, Deloitte, Accenture, Dragos, Hitachi, and Rockwell Automation. This builds on a program launched in June that already supplies Claude models and security support to more than half of all US states.

Raw model reports for open source

Inspired by Google’s OSS-Fuzz, Anthropic also launched OSS Scanner, an opt-in service that gives open-source maintainers periodic, free code scans powered by its strongest models, including Claude Mythos.

Instead of waiting months for human security teams to triage every bug, OSS Scanner sends raw, model-generated reports straight to maintainers. Each report includes an exploit proof-of-concept, a root-cause explanation, and a candidate patch.

Anthropic expects a true-positive rate above 90%. In early testing across 48 projects, penetration testers reviewed 97 critical and high-severity findings and verified that 85 (88%) were real. Maintainers have already asked for and received nearly 5,000 unverified bug reports.

The response from top-tier open-source teams has been enthusiastic. OpenSSL noted that receiving reports with functional exploits attached allows engineers to verify issues instantly. wolfSSL received 74 reports, found all but two valid, and logged five CVEs. curl creator Daniel Stenberg confirmed that the scanner caught several real issues, including one of curl’s worst vulnerabilities in recent years.

To ensure maintainers aren't overwhelmed, Anthropic is backing the effort with its Defender Advantage Fund (0xDAF) and funding key organizations like the Python Software Foundation and the OpenSSF.

Why it matters

Anthropic's thesis is that AI will favor defense in two years, but right now, attackers have the upper hand. Generating exploits takes seconds, while verifying and patching legacy code still takes humans months.

For open-source maintainers who have the bandwidth to triage, OSS Scanner is an absolute no-brainer to try immediately. Getting a complete proof-of-concept alongside a proposed patch transforms AI bug reports from annoying inbox spam into actionable developer tools.

However, the move comes with clear operational risks. Dumping raw, model-generated vulnerability reports onto underfunded open-source volunteers could easily backfire if false positives creep up. It works brilliantly for well-resourced projects like PostgreSQL or wolfSSL, but smaller teams could drown in triage overhead.

Strategically, Anthropic is playing a brilliant long game. While competitors pitch AI as a productivity booster, Anthropic is embedding itself into critical utility grids, consulting giants, and open-source foundations. Positioning Claude as the indispensable guardian of global infrastructure builds an institutional moat that is extraordinarily hard to displace.