Anthropic on October 8 unveiled the "Anthropic Cyber Mission," a long-term security initiative split along two tracks: defending critical infrastructure, and giving open-source software free AI-powered vulnerability scans. The open-source service, called OSS Scanner, is opt-in and free for enrolled projects.
Open-Source Projects Can Sign Up for Free AI Scans
OSS Scanner is modeled on Google's OSS-Fuzz. Once enrolled, an open-source project gets periodic code scans from Anthropic's strongest models, including Claude Mythos, and maintainers automatically receive model-generated vulnerability reports. Enrollment runs through a GitHub-based application process; Anthropic reviews projects case by case, prioritizing ones with critical infrastructure or security implications. The service is funded through the company's Defender Advantage Fund (0xDAF), and participation will remain free.
Reports Are Fully Model-Generated, With No Human Review
29,000 Candidate Vulnerabilities Flagged in Six Months
Maintainers Say Reports Rival Human Ones
Maintainers of well-known projects gave concrete feedback. Todd Ouska of wolfSSL said that of the 74 reports received, all but two were valid, and five became CVEs. Noah Misch of PostgreSQL said an unusually high fraction of findings uncovered real PostgreSQL defects, and several reports arrived with fixes his team could use nearly as-is. Anton Arapov of OpenSSL Corporation said the reports were as good as or better than what his organization gets from people. Eddie Kohler of HotCRP described them as thorough and clear. Crypto projects moved fast on day one: Ethereum client developer Nethermind applied for audits of its entire repository, and ZEUS, a self-custodial Bitcoin and Lightning wallet, asked to have its app examined for weaknesses affecting payments and private keys.
Accenture Joins as Founding Partner, Scanning Goes Routine
In parallel, Anthropic folded its cyber defense program for state, local, tribal, and territorial governments — launched in June — into the Mission: it has since supplied frontier Claude models and technical support to more than half of all US states and some of the country's largest public critical infrastructure operators, speeding up code scanning, patching, and red teaming. Accenture joined as a founding partner. The company also expanded its Cyber Verification Program into three tiers and opened Claude Mythos 5.1 to more vetted security teams. Anthropic's argument is that both attackers and defenders are already using AI, so the only winning move is to give defenders the stronger tool first.
