Anthropic launches the Cyber Mission to help defend critical infrastructure and open source software
We’re launching the Anthropic Cyber Mission, a new effort to secure critical infrastructure and open-source software.
Context
Anthropic is putting its strongest models, engineers and free scanning in the hands of defenders of power, water and open source code, at a time when it says attackers already have highly capable AI.
Anthropic says the Cyber Mission builds on Project Glasswing, its earlier effort in which partners and Anthropic scanned widely used software for vulnerabilities. Earlier the same week, Anthropic merged Glasswing into an expanded Cyber Verification Program that gives more defenders access to its most capable models. The launch comes as AI assisted attacks draw attention, including the South Korean bank hacks covered earlier in this deck.
Deep dive
Anthropic announced the Cyber Mission on October 8 as a long term effort to support defenders with tools, research and resources. It starts with two areas: critical infrastructure and open source software.
For critical infrastructure, Anthropic introduced the Critical Infrastructure Defense Program, which brings frontier Claude models, on site engineers and Anthropic's threat research to the providers that secure operational technology such as power grids, water systems and transportation networks. Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several partners are already working with Claude to fix vulnerabilities, and that it has offered models and support to more than half of US states since launching a program for state and local governments in June.
For open source, Anthropic launched OSS Scanner, an opt in service inspired by Google's OSS Fuzz. Enrolled projects receive periodic scans from Anthropic's most capable models for free. Each report includes a proof of concept, an explanation and, where available, a suggested fix. Anthropic says the reports are generated by models and sent without human review, so some will contain inaccuracies, and that it expects a true positive rate above 90%. Projects that cannot keep up with findings will continue to get human verified disclosures.
Anthropic also says it has funded groups including the Python Software Foundation, OpenSSF and the Apache Software Foundation. It forecasts that within two years AI will favor defense, but says that may not be true in the near term because exploiting bugs has become cheaper while fixing them is still slow.
What to expect next
Anthropic says it will bring the Critical Infrastructure Defense Program to more partners and sectors over the coming months and share what it learns, including what did not work.
Watch how maintainers react to OSS Scanner reports that arrive without human review, and whether the true positive rate holds above the 90% Anthropic expects. Anthropic also says it expects other AI developers, security companies and governments to launch similar efforts.