The software running your power grid just got a free AI security scanner. Here's what that actually means.

The apps on your phone are built on top of hundreds of open-source software libraries you've never heard of. NumPy. Requests. Webpack. Thousands more. Some of those have security vulnerabilities sitting unpatched in them right now. Most get found by human researchers, eventually. Anthropic just launched a free tool that has Claude scan them on a schedule, automatically.

That's the smaller half of the Anthropic Cyber Mission, announced October 8. The larger half is a Critical Infrastructure Defense Program (CIDP), a partnership with 11 founding security companies (CrowdStrike, Dragos, Palo Alto Networks, Rockwell Automation, Accenture, Booz Allen, Deloitte, Hitachi, Insane Cyber, Nozomi Networks, and PwC) that puts frontier Claude models and Anthropic engineers directly inside their work. The target is operational technology, or OT: the software running power grids, water treatment systems, transportation networks, and government systems.

OT is not your app. It's the firmware on a substation relay. The controller telling a pump to run. OT is ancient by tech standards, often decades-old, and when it fails something physical fails with it.

Source spread

• Anthropic — Anthropic Cyber Mission — [builder]. The official launch announcement. Source for all partner names, OSS Scanner mechanics, and the two-year defense-favors-AI forecast. Independent tech media coverage of the program exists but wasn't accessible at time of writing.

What's real

• OSS Scanner is free and genuinely opt-in. The Python Software Foundation, OpenSSF (via Linux Foundation), and the Apache Software Foundation are already enrolled as supporting organizations. Each scan produces a report with a proof of concept, an explanation, and a suggested fix. If a project doesn't have capacity to handle findings, Anthropic still issues human-verified disclosures under their coordinated vulnerability disclosure policy.
• The CIDP partners are serious players. CrowdStrike, Dragos, and Palo Alto Networks aren't PR operations. They're operational security companies who understand OT environments. The founding cohort is small by design: Anthropic says this phase is about learning which strategies actually work in industrial systems, before expanding.
• This expanded from something that was already quietly running. Since June, Anthropic had already been providing Claude models and technical support to more than half of US states for state, local, tribal, and territorial government cyber defense. The Cyber Mission is a formalization, not a cold start.
• Project Glasswing got folded in. Anthropic merged its vulnerability research program into an expanded Cyber Verification Program. The scope grew; the name got cleaner.

What deserves a side-eye

• "Within two years, AI will favor defense" is a forecast, not a fact. It's the kind of claim that ages well into oblivion if nothing is pinned to it. I'll be holding them to it.
• Finding vulnerabilities in OT is not the same as fixing them. Anthropic acknowledges this directly: some OT fixes may take decades to apply safely. A power utility can't take substations offline for a week to push a patch. The gap between "AI found this" and "this is now fixed in production" is exactly where the meaningful work lives, and AI doesn't obviously close it.
• The 90%+ true-positive rate is an expectation, not a measurement. OSS Scanner reports are model-generated and not human-reviewed. For security work, "we expect" and "we have demonstrated" are very different calibrations.

What to do about it

• If you maintain an open-source project, register interest through Anthropic's Cyber Mission page. The OSS Scanner is free and opt-in. You get a report with a proof of concept and suggested fix.
• If you're a security builder at an enterprise or infrastructure company, the CIDP is currently a small founding cohort. Security providers can register interest for future cohorts through the same page.
• If you just use apps (which is everyone): this doesn't protect you directly today. What it does is increase the rate at which unpatched vulnerabilities in widely-used open-source code get found before attackers do. That's good, with a lag.
• Don't mistake scanning for patching. The bottleneck in infrastructure security isn't finding vulnerabilities. If you work in critical infrastructure, the patch deployment pipeline is still your problem to solve.

Further reading

• Anthropic — The Anthropic Cyber Mission — full announcement, CIDP partner list, OSS Scanner enrollment info