Anthropic put its strongest AI on full-time defense duty. Power grids are first.

Most of the software running the power station that keeps your lights on was written before smartphones existed. Some of it runs on operating systems that haven't had a security patch in a decade. The people defending it are understaffed, working with tools built for a different era, and now facing adversaries who use AI to find vulnerabilities faster than any human team can track.

That's the problem Anthropic's Cyber Mission is built around. Announced October 8, 2026, it commits frontier model access, on-site Anthropic engineers, and a free scanning tool to two classes of defenders who've historically been underequipped: critical infrastructure operators and open-source software maintainers.

Here's the quick version of what the announcement actually contains: two new programs (the Critical Infrastructure Defense Program and OSS Scanner), the merger of Project Glasswing into an expanded Cyber Verification Program with three access tiers, and an honest admission that finding vulnerabilities wasn't the hard part.

Source spread

• Anthropic — Introducing the Anthropic Cyber Mission — [hype]. Company announcement; candid about what Project Glasswing learned, which is unusual for a launch post.
• Anthropic — Expanding the Cyber Verification Program — [builder]. Companion announcement from October 6 detailing the three-tier CVP structure, eligibility, and application process.
• Anthropic — Project Glasswing initial update — [builder]. May 2026 report from the first six months; documents the gap between finding and fixing.

What's real

• The problem they're diagnosing is correct. Operational technology — OT is the industrial controllers, SCADA systems (think: the software that manages a water treatment plant), and embedded hardware running on power grids. It's deeply vulnerable and nearly impossible to patch without taking systems offline. Defenders here are chronically under-resourced.
• OSS Scanner is the cleanest part of this. Free, opt-in, recurring security scans of open-source projects using Claude's strongest models, with proposed patches in the output. If it works as described, the marginal cost is low and the upside for the OSS maintainer who can't afford a dedicated security team is real.
• Project Glasswing's admission is worth sitting with. Anthropic's own post says: "It's easier than ever to find vulnerabilities, but verifying, prioritizing, and fixing these findings remains challenging." Six months of intensive AI-assisted scanning found over 10,000 zero-days. Most are still open. The bottleneck isn't discovery anymore — it's remediation.

What deserves a side-eye

• "On-site Anthropic engineers" doesn't scale. There are thousands of critical infrastructure operators across the US. A program that deploys people on-site works as a pilot and a proof-of-concept. It is not an industry solution.
• The methodology on "10,000+ zero-days" isn't fully public. That number has spread widely. How a zero-day was defined and counted in the Glasswing methodology matters a lot for evaluating the claim, and Anthropic's documentation on this is limited.
• This is also customer acquisition. Defenders who sign up for CIDP get access to frontier models, including Claude Mythos 5.1. That's a real benefit. It's also a path to commercial relationships with organizations that control critical systems. Both things are true.

Samwise's take

What builders need to know

• If you work in security, the expanded CVP is the practical update. Three tiers are now available: Defense Access (SOC teams, incident response, reverse engineering malware, vulnerability analysis), Red Team Access (authorized pen testing, red teaming), and a higher tier for advanced capabilities. Apply at Anthropic's CVP page. Defense tier response target is "a few days."
• OSS Scanner is available now, free. Open-source maintainers can sign up for recurring scans from Claude Opus 5.5 and Mythos 5.1 that output proposed patches alongside findings. If you maintain a project that could use a security pass and don't have budget for one, this is the easy call.
• If you operate OT infrastructure and qualify for CIDP, apply. Power grid operators, water utilities, transportation infrastructure — the program deploys Anthropic engineers and frontier model access to your team. It's the right fit for organizations that have specialized knowledge but need additional capability.
• If you were in Project Glasswing, check for transition details. The program has been fully merged into the expanded CVP. Your access path going forward runs through the CVP tiers.

Further reading

• Anthropic — Introducing the Anthropic Cyber Mission — full launch announcement
• Anthropic — Expanding the Cyber Verification Program — three-tier structure, eligibility, application
• Anthropic — Project Glasswing initial update — six-month findings and lessons