Anthropic
Blogcast

Alex: Welcome back to the Anthropic Blogcast, the show where we turn every new Anthropic announcement into a conversation you can listen to. I'm Alex.

Jordan: And I'm Jordan. And today, Alex, we are talking about something big. On October eighth, Anthropic launched a brand new, long-term initiative called the Anthropic Cyber Mission, and it is all about cybersecurity defense.

Alex: Right. This isn't a product launch or a new model. It's a mission, in the real sense of the word. Anthropic is committing to securing the systems everyone depends on, and they're going to do it by giving defenders better tools, research, and resources.

Jordan: And the reason they're doing this now is pretty striking. Let's start there, because the motivation is the whole story. Frontier AI models are now so capable that they can be misused to find vulnerabilities and run cyber operations. State-sponsored adversaries have spent years embedding footholds across all kinds of sectors.

Alex: Meanwhile, the people defending those systems, the security teams at power grids and water utilities, and the volunteer maintainers of open-source software, have deep expertise but brutal resource shortages. It's an asymmetry problem. Attackers get cheap AI power, and defenders are still doing slow, manual work.

Jordan: And Anthropic has some recent experience that backs this up. Through their Project Glasswing effort, they scanned hundreds of widely used open-source projects and their partners found a lot of vulnerabilities. But here's the kicker, and Anthropic says this openly: finding vulnerabilities is easy now. Verifying them, prioritizing them, and actually getting them fixed is still hard.

Alex: That's such an important line. In Glasswing, months often passed between a vulnerability being found and it being fixed. And for the industrial systems we'll talk about in a minute, a fix can sometimes wait decades, because you can't just take a running factory offline to patch it.

Jordan: So the Cyber Mission is Anthropic's answer, and it has two focus areas. First, critical infrastructure. Second, open-source software. Let's take those one at a time.

Alex: Okay, critical infrastructure. Think power grids, water utilities, factories, transportation networks. These run on something called operational technology, which is the world of industrial controllers, control software, and industrial networks. This equipment was built to last decades, and a lot of it simply cannot be taken offline for patching. So known vulnerabilities can sit there, unresolved, for years.

Jordan: And securing it is genuinely specialized work. The equipment is often proprietary, any change is risky, and a mistake can literally take down a plant. The operators rely on a small set of trusted providers to do this work.

Alex: So Anthropic is launching something called the Critical Infrastructure Defense Program, or C I D P, which brings frontier Claude models, on-site Anthropic engineers, and Anthropic's own threat research directly to those trusted providers. It starts with eleven founding partners.

Jordan: Let's name them, because it's a heavyweight list. Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. Consulting and technology firms, security companies, and equipment manufacturers, all in one cohort.

Alex: And work is already underway. Anthropic says several of these partners are already using Claude to fix vulnerabilities. They're starting with a small cohort on purpose, to learn which strategies are actually effective and practical before expanding.

Jordan: There's some history here too. Back in June, Anthropic launched a cyber defense program for state, local, tribal, and territorial governments. Since then, they've offered frontier Claude models and technical support to more than half of US states and some of the largest public critical infrastructure operators. That existing work has been speeding up code scanning and patching, incident response, red teaming, and other security workflows.

Alex: So C I D P builds on that foundation. Now let's go to the second pillar, which I think is going to fascinate our developer audience, because it's about open-source software.

Jordan: Almost all software depends on open-source code, and a huge amount of it is maintained by small volunteer teams. Under Project Glasswing, Anthropic scanned hundreds of widely used open-source projects. Humans triaged and reviewed many findings and privately reported them to maintainers through their coordinated vulnerability disclosure process.

Alex: But some maintainers, the ones with the capacity to triage at scale, said something interesting. They said, give us everything the models find, reviewed or not. So Anthropic built OSS Scanner. It's a free, opt-in service inspired by Google's OSS-Fuzz. Enrolled projects get periodic scans from Anthropic's most capable models, at no charge.

Jordan: And each report comes with three things. A proof of concept showing how the bug could actually be exploited. An explanation of the flaw. And a suggested fix, where one is available. That is genuinely useful output for a maintainer.

Alex: Now the honest tradeoff. These reports are model-generated and sent without human review, which means they arrive fast, but some will contain inaccuracies, like a wrong severity rating. Anthropic expects a true-positive rate above ninety percent and says they'll keep working to improve it. And for projects that lack the capacity to handle findings, Anthropic continues its human-verified disclosures under its coordinated disclosure policy.

Jordan: They also laid out what's next for the open-source work. Three goals. First, get findings to maintainers faster, by bringing OSS Scanner to more projects while keeping human-verified disclosure where it's needed. Second, accelerate fixes by automating triage and patching, which is still mostly manual today, for the projects that want it. Third, research fundamentally new secure architectures and coding practices, actually hardening or rewriting code with projects that want to go beyond patching.

Alex: And this is all funded. The Defender Advantage Fund, launched back in August, supports pilot programs and keeps OSS Scanner free. Anthropic has funded the Python Software Foundation, Alpha-Omega and the Open S S F, and the Apache Software Foundation, plus two organizations called Akrites and Gold Eagle, which collect and coordinate vulnerability reports from many sources so maintainers don't get overwhelmed.

Jordan: Plus, open-source maintainers can apply for Claude for Open Source, which is free Claude Max subscriptions, and they can apply to the expanded Cyber Verification Program for broader access to Claude's cyber capabilities for defensive work.

Alex: Now let's talk about the bigger thesis, because Anthropic included a forecast in this announcement that's worth quoting. Their forecast is that in two years, AI will favor defense. It will get easier to catch bugs before software ships, to write fundamentally secure software, and to actively defend systems with models.

Jordan: But they're very clear that this may not be true in the near term. Right now, the cost of exploiting vulnerabilities has dropped, thanks to capable AI, while verifying, disclosing, and fixing them is still slow and human-dependent. That gap is the dangerous part.

Alex: And their definition of success is nicely concrete. Critical infrastructure like water, power, transport, and communications keeps running against capable adversaries, with fewer exploitable paths in and faster recovery when something gets through.

Jordan: They also said this will take years, and that the mission will evolve as they learn together with the public and private sectors. This is explicitly a long-term commitment, not a one-off announcement.

Alex: And there are calls to action. Security vendors, system integrators, and equipment manufacturers for critical infrastructure can register their interest in the defense program. Core maintainers of critical open-source projects can enroll in OSS Scanner. And security teams of any size can apply to the expanded Cyber Verification Program for model access.

Jordan: One thing worth noting, Alex. This connects directly to their October sixth announcement about expanding the Cyber Verification Program, which we covered a couple of episodes ago. Project Glasswing got folded into that program, opening up Mythos-class and Claude five point five models to qualified defenders. The Cyber Mission is the bigger strategy, and the verification program is one of its tools.

Alex: Good catch. So in less than a week, we've seen Anthropic restructure its whole cyber defense apparatus. First the verification program expansion, now a full mission with two operational programs, funding, and eleven enterprise partners.

Jordan: I'll be honest, the OSS Scanner piece is the one I'm most excited to watch. Free, opt-in, periodic scans from frontier models with proofs of concept and suggested fixes, landing directly in the inboxes of open-source maintainers. If the true-positive rate really stays above ninety percent, that's a meaningful upgrade for the whole software supply chain.

Alex: And the critical infrastructure side is the one with the highest stakes. Water, power, transport. These are systems where you don't get second chances, and where defenders are out-resourced. Putting frontier models and engineers directly with the trusted providers is a real commitment.

Jordan: So that is the Anthropic Cyber Mission. A long-term push to close the gap between how cheap AI has made attacking and how slow defense still is, starting with the power grids and the open-source code the world runs on.

Alex: We'll be watching to see how those first eleven partners do, and whether OSS Scanner lives up to its promise. Thanks for listening to the Anthropic Blogcast. I'm Alex.

Jordan: And I'm Jordan. We'll be back with the next announcement.