Anthropic on October 8 unveiled the "Anthropic Cyber Mission," a long-term security initiative split along two tracks: defending critical infrastructure, and giving open-source software free AI-powered vulnerability scans. The open-source service, called OSS Scanner, is opt-in and free for enrolled projects.
OSS Scanner is modeled on Google's OSS-Fuzz. Once enrolled, an open-source project gets periodic code scans from Anthropic's strongest models, including Claude Mythos, and maintainers automatically receive model-generated vulnerability reports. Enrollment runs through a GitHub-based application process; Anthropic reviews projects case by case, prioritizing ones with critical infrastructure or security implications. The service is funded through the company's Defender Advantage Fund (0xDAF), and participation will remain free.
According to Anthropic, each report ships with a self-contained reproducer or proof of concept, an explanation that includes bisection where possible, and a candidate patch when one is available. The trade-off for speed and frequency is that human review is skipped entirely: the company acknowledges that reports can be wrong or invalid, including wrong severity ratings, but expects a true-positive rate above 90%. The program builds on Project Glasswing, through which the company had already scanned more than 1,000 open-source projects with human-reviewed reporting.
To validate an early version, Anthropic had the expert penetration testers who review its coordinated-disclosure findings audit 97 critical and high-severity scanner findings across 48 projects: 85 (88%) met its disclosure bar, 11 of the remainder were real but duplicated known issues, and one was a false positive. The company also said its models flagged more than 29,000 candidate vulnerabilities over the past six months, of which roughly 6,000 were manually reviewed and triaged, while nearly 5,000 unverified reports went directly to maintainers who had asked to receive everything.
Maintainers of well-known projects gave concrete feedback. Todd Ouska of wolfSSL said that of the 74 reports received, all but two were valid, and five became CVEs. Noah Misch of PostgreSQL said an unusually high fraction of findings uncovered real PostgreSQL defects, and several reports arrived with fixes his team could use nearly as-is. Anton Arapov of OpenSSL Corporation said the reports were as good as or better than what his organization gets from people. Eddie Kohler of HotCRP described them as thorough and clear. Crypto projects moved fast on day one: Ethereum client developer Nethermind applied for audits of its entire repository, and ZEUS, a self-custodial Bitcoin and Lightning wallet, asked to have its app examined for weaknesses affecting payments and private keys.
In parallel, Anthropic folded its cyber defense program for state, local, tribal, and territorial governments — launched in June — into the Mission: it has since supplied frontier Claude models and technical support to more than half of all US states and some of the country's largest public critical infrastructure operators, speeding up code scanning, patching, and red teaming. Accenture joined as a founding partner. The company also expanded its Cyber Verification Program into three tiers and opened Claude Mythos 5.1 to more vetted security teams. Anthropic's argument is that both attackers and defenders are already using AI, so the only winning move is to give defenders the stronger tool first.