1. Home
2. News
3. Anthropic

Anthropic offers Claude and on-site engineers to power grid defenders, plus free open-source bug scans

The open-source scanner's bug reports go out with no human reading them first, and Anthropic expects most to be right.

By Think Facility · October 8, 2026 · Anthropic Cybersecurity Save

On October 8, 2026, Anthropic launched the Anthropic Cyber Mission, which it calls "a long-term commitment to securing the systems everyone depends on." It starts in two places: the industrial systems behind power grids and water plants, and the open-source code most software is built on.

For the first, Anthropic will send Claude models, on-site engineers and threat research to the security firms that infrastructure operators already hire. For the second, it's giving open-source projects free scans from its strongest models.

Launched

Oct 8, 2026

Founding partners

11, including CrowdStrike, Dragos and Rockwell Automation

Open-source offer

OSS Scanner, free of charge

Expected true-positive rate

above 90%

Why the grid is hard to patch

Grids, water utilities and factories run on operational technology. Much of it can't be taken offline to patch, Anthropic writes, so known holes can stay open for years.

So the new Critical Infrastructure Defense Program works through the providers operators already trust (security firms, and the manufacturers that build and patch the gear). Its founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Several are already using Claude to fix vulnerabilities, according to Anthropic.

The partners' statements on the page are mostly about speed. PwC's is about what's at stake.

Granted, it isn't Anthropic's first government-facing cyber work. In June it opened a program for state, local, tribal and territorial governments, and it says that's now reached more than half of all US states.

Free scans for open source, sent unread

OSS Scanner is opt-in. Enrolled projects get periodic scans from Anthropic's most capable models, free, and each report carries a proof of concept and, where there is one, a suggested fix. Nobody at Anthropic reads the reports before they go out.

Anthropic expects a true-positive rate above 90%, and it says plainly that some reports will still be wrong (a severity rating, for instance). The service is meant for projects that can keep up with a stream of findings. Smaller ones keep getting human-checked disclosures.

It also funded the Python Software Foundation and the Apache Software Foundation, plus Alpha-Omega and OpenSSF through the Linux Foundation.

Defenders are behind for now

Anthropic is blunt that the near term favors attackers. Exploiting bugs has gotten cheaper, while fixing them is slow and still depends on people. In Glasswing (its earlier scanning project), months often passed between a vulnerability being found and being fixed.

Industrial gear is slower still. A fix may have to wait until it can be applied safely to running machinery, and in rare cases, Anthropic says, that could take decades.

The same week, Anthropic folded Glasswing into its expanded Cyber Verification Program. Over the coming months it plans to bring the infrastructure program to more partners and more sectors.