Anthropic put its strongest models behind free security scans of open source
Anthropic launched the Anthropic Cyber Mission on Thursday with two programs. The Critical Infrastructure Defense Program gives frontier Claude models, on-site engineers and threat research to eleven partners — Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation — working on power grids, water systems and transport. OSS Scanner, inspired by Google’s OSS-Fuzz, gives open-source projects periodic vulnerability scans with Anthropic’s strongest models, including Claude Mythos, at no cost.
Enrolment is a pull request to Anthropic’s oss-scanner repository adding a project.yaml, so the scanning agent can build and audit the project in a sandbox with no internet access. Reports are fully model-generated and sent without human review, and Anthropic warns some will be wrong — a mis-rated severity, say — while expecting a true-positive rate above 90%. It says that of more than 29,000 candidate vulnerabilities its models flagged in six months, staff have manually reviewed about 6,000.
WHY IT MATTERS
The interesting move is turning frontier cyber capability toward defence at the layer everyone depends on and few can pay to audit — the maintainer-run project — and accepting a visible error rate to get throughput. For anyone consuming an open-source dependency, a free scan from a frontier model is close to a best-case threat model, and the model-generated report format — reproducer, bisection, candidate patch — is the shape a coding agent can act on directly. The caveat deserves one line: reports arrive unreviewed, so a maintainer still has to triage them, and Anthropic has not said who covers the compute for the infrastructure partners.