Anthropic's Cyber Mission: What It Actually Contains

Anthropic launched the Anthropic Cyber Mission, a long-term program that combines frontier models, engineers, and funding to protect critical infrastructure and open-source software. The program's main issue is the lack of balance between the cost of exploiting vulnerabilities and the cost of verifying, disclosing, and fixing them.

In Project Glasswing, Anthropic found that it often took months for a bug to be fixed after it was discovered, and the bottleneck was not in discovery but in triage, prioritization, and patching, all of which still depended on human intervention.

A significant challenge is that critical infrastructure and open-source software are maintained by organizations with limited resources and no dedicated security budgets. To address this, the Cyber Mission has two main pillars. The Critical Infrastructure Defense Program (CIDP) involves deploying frontier Claude models, on-site engineers, and threat research to trusted providers that operators already use, such as consultancies, security vendors, and equipment makers.

The second pillar, the OSS Scanner, provides free, opt-in security scans for open-source projects, generating model-generated reports that include a proof of concept, explanation of the vulnerability, and a suggested fix. While the service is aimed at projects with the capacity to handle the findings, those that cannot still receive human-verified reports through Anthropic's coordinated vulnerability disclosure process.

Additionally, Anthropic has funded several organizations, including the Python Software Foundation, Alpha-Omega, OpenSSF through the Linux Foundation, and the Apache Software Foundation, and launched the Defender Advantage Fund to support pilot programs and maintain OSS Scanner's free status. The ultimate goal of Anthropic's Cyber Mission is to ensure that water, power, transport, and communications systems remain operational even under attack from sophisticated adversaries with a reduced number of exploitable vulnerabilities and faster recovery times.