Anthropic's Cyber Mission: What the Critical Infrastructure Defense Program Means for OT Security Teams

Anthropic's Cyber Mission announcement bundles two genuinely different things under one name, a partnership program aimed at the hardest part of critical infrastructure security, operational technology that is too disruptive to take offline for patching, and a free automated vulnerability scanner for open source projects that already has a measurable track record. Conflating them in coverage is easy and misleading, because they carry very different maturity levels and very different implications for a security buyer evaluating what this actually means.

The Critical Infrastructure Defense Program: early and deliberately narrow

The program's pitch is straightforward: Anthropic provides frontier Claude models, its own engineers, and threat research to organizations that protect power grids, water utilities, and transport networks, specifically targeting operational technology, controllers, control software, and industrial networks, that is notoriously hard to patch because taking it offline has real world physical consequences. Eleven founding partners signed on: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation, spanning the major OT security vendors, the big systems integrators and consultancies, and an industrial conglomerate in Hitachi, which is joining working groups specifically to share operational technology domain expertise that Anthropic's own team does not have in house.

What's conspicuously unresolved: who pays for the compute Claude models running against OT environments would consume, whether partners get free model access as part of the arrangement, and, per reporting that cited Axios, how partners test proposed fixes against live utility infrastructure without risking disruption to the systems they're trying to protect, which is precisely the problem OT security has always struggled with and that an AI model recommending a patch doesn't automatically solve. Anthropic has said explicitly that it is starting with a small group of providers specifically to learn what works, which is the right instinct for a program at this stage, but it also means there is no finished methodology to evaluate yet, only a stated intent and a credible partner list.

The OSS Scanner: smaller in ambition, more concrete in results

The OSS Scanner is more immediately evaluable because it has run for six months and produced numbers. It is opt in, modeled on Google's OSS-Fuzz, and scans open source code with Anthropic's most capable models, generating reports that can include a proof of concept, an explanation, and a suggested patch. Anthropic selects projects case by case, limiting scope to established projects with critical impact on infrastructure and user security rather than scanning indiscriminately. Reported results: more than 29,000 candidate vulnerabilities flagged over six months, of which staff reviewed roughly 6,000 and nearly 5,000 unreviewed reports went directly to maintainers who specifically asked to receive everything unfiltered. In a more tightly audited sample, 97 critical and high severity findings across 48 projects: 85 met Anthropic's disclosure bar, 11 were real but duplicated already known issues, and exactly 1 was a false positive. The single most concrete data point: wolfSSL received 74 reports, all but two of which were valid, and five became actual CVEs. Daniel Stenberg of curl, whose project depends on wolfSSL, is on record saying the scanner "has helped us find multiple issues in curl worthy of addressing."

That false positive rate, roughly 1 percent in the audited sample, is a genuinely strong result for automated vulnerability discovery at this scale, and it's the kind of number that should inform how enterprise security teams think about AI assisted code scanning generally, not just this specific tool. But maintainers still have to review every report themselves. Anthropic's own service agreement warns that reports may misjudge severity or propose patches that break something else, and liability for any given report is capped at $1,000, which tells you plainly where Anthropic has decided the risk boundary sits: useful enough to offer for free at scale, not warrantied enough to stand fully behind.

What this means if you're evaluating AI security vendors, not just reading the press release

For a security team sizing up what "an AI company doing cybersecurity partnerships" actually signals about vendor maturity, the two halves of this announcement point in different directions and should be weighed separately. The OSS Scanner's six month track record, with real CVEs and a low false positive rate in its audited sample, is evidence you can actually use when deciding whether to trust AI assisted vulnerability scanning in your own supply chain, and if your org depends on any of the open source projects Anthropic has scanned, checking whether your dependencies received reports is a reasonable use of an afternoon. The Critical Infrastructure Defense Program, by contrast, is a credible partner list and a stated intent with no public methodology yet; treat it as a signal that Anthropic is investing seriously in OT security relationships worth tracking, not as a vendor capability you can currently procure or evaluate against a competing offering. Anthropic's own stated forecast, "in two years, AI will favor defense," is a bet about the direction of travel, not a claim about where the program stands today.

When this applies to your stack

If your organization runs or depends on operational technology, water, power, transport, or manufacturing control systems, the Critical Infrastructure Defense Program is worth a conversation with your existing OT security vendor about whether they're among the eleven partners or plan to be, but it is not yet something with a defined engagement model you can request directly. If your organization maintains or depends heavily on open source infrastructure, checking your dependency tree against OSS Scanner's public disclosures, and understanding the liability terms before treating any report as authoritative, is the more immediately actionable step. For clients asking us to evaluate AI vendor security claims as part of a broader AI integration engagement, separating announced intent from demonstrated track record, the same split this program itself contains, is the first filter we apply.

FAQ

Can my organization join the Critical Infrastructure Defense Program directly? Not as currently described. Anthropic has named 11 founding partners and stated it is starting with a small group to learn what works, with no public process yet for additional organizations to join directly rather than through a founding partner relationship.

Is the OSS Scanner the same thing as the Critical Infrastructure Defense Program? No. The OSS Scanner is a free, opt in automated vulnerability scanning service for open source projects that has run for six months with measurable results. The Critical Infrastructure Defense Program is a separate, newer partnership effort aimed at operational technology in power, water, and transport sectors, described by Anthropic as the first part of the broader Cyber Mission.

What happens if the OSS Scanner's suggested patch is wrong? Anthropic's service agreement states that reports may misjudge severity or propose patches that break something, and caps its liability at $1,000 per report. Maintainers are expected to review every report before acting on it; it is not an autonomous patching system.

Has the OSS Scanner actually found real vulnerabilities? Yes. In an audited sample of 97 critical and high severity findings across 48 projects, 85 met Anthropic's disclosure bar as real, previously unknown issues, 11 were real but duplicated known issues, and 1 was a false positive. wolfSSL alone had 74 reports, nearly all valid, with five becoming CVEs.

Why is operational technology harder to secure than standard enterprise IT? Because taking OT systems, grid controllers, water treatment control software, transport signaling, offline for patching risks real world physical disruption in a way a standard enterprise server reboot does not, which is exactly why Anthropic's reported own program framing calls critical infrastructure "hard to defend in many ways that AI cannot fix."