Will Anthropic's new security program protect infrastructure and open source?

Anthropic has announced the launch of its Cyber Mission, a dedicated initiative designed to bolster defenses for critical infrastructure and open-source software projects. According to The Register, the company aims to provide defenders with access to the same powerful tools that attackers are increasingly leveraging, attempting to close a widening security gap.

What is the core strategy behind this initiative?

The Anthropic Cyber Mission operates across two primary domains: critical infrastructure defense and open-source security scanning. The company acknowledges that attackers currently hold an advantage, a situation it expects to persist for the next two years. By deploying its most sophisticated models, Anthropic seeks to equip defenders with proactive capabilities to identify and remediate vulnerabilities before they can be exploited by malicious actors.

How does the infrastructure defense program function?

The Critical Infrastructure Defense Program combines Anthropic’s highest-tier AI models with on-site human engineers, sometimes called forward-deployed engineers. This hybrid approach recognizes that while AI coding agents are powerful, human security expertise remains essential, particularly in organizations lacking in-house machine learning talent. The goal is to prevent scenarios where AI-assisted attacks could exploit zero-day vulnerabilities in systems like SCADA networks that control public utilities.

Which partners are involved in the infrastructure effort?

Anthropic is collaborating with a wide range of industry partners to execute this defense strategy. The partner list includes Accenture, Booz Allen, CrowdStrike, Deloitto, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. These organizations bring existing ties to critical infrastructure sectors and established experience in safeguarding technical frameworks that are under constant scrutiny by automated AI agents.

Who qualifies for the open-source security scans?

The second pillar of the mission is the OSS Scanner, which provides regular security scans using Anthropic’s strongest models at no cost. However, this service is not available to every open-source project. Eligibility criteria mirror those used by Google for its OS-FUZZ project, meaning the service targets established projects that have a critical impact on infrastructure stability and user security, rather than offering blanket coverage to all repositories.

What to do and how to stay safe: Anthropic

• Review your organization's critical infrastructure assets to identify potential exposure to AI-assisted attack vectors.
• Assess whether your open-source dependencies fall within the scope of high-impact projects eligible for external security scanning services.
• Ensure your security teams have the necessary training to interpret and act on findings from advanced AI-driven vulnerability assessments.
• Monitor vendor announcements for updates on eligibility criteria and new partner integrations for infrastructure defense programs.

Step-by-step guide: How AI Risk Management Works: The Hidden Failure Points

General security guidance from the Sandbox Dispatch newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Does Anthropic's OSS Scanner cover all open-source projects?

No, the service is limited to established projects with a critical impact on infrastructure and user security, similar to Google's OS-FUZZ criteria.

How long does Anthropic expect attackers to have the advantage?

According to The Register, Anthropic states that attackers will likely hold the advantage for the next two years.

Are human engineers still part of the defense strategy?

Yes, the Critical Infrastructure Defense Program pairs AI models with on-site engineers to handle complex security challenges.