Anthropic Launches Cyber Mission: A Free AI Vulnerability Scanner With Over 90% Expected Accuracy

Anthropic has launched Cyber Mission, a program that combines two efforts: protecting critical infrastructure and checking open-source software for vulnerabilities. CrowdStrike and Palo Alto Networks are the partners. They will help secure power grids and water supply systems. For open-source projects, the company has released a free AI scanner that automatically looks for vulnerabilities. The stated expected accuracy is above 90%. The news was reported by The Decoder.

Two Missions Under One Name

The program tackles problems that usually sit in different domains. Power grids and water utilities are industrial systems with long update cycles and a high cost of downtime. Open-source libraries are the code that nearly all modern software depends on, yet they are maintained by small teams and often by individual volunteers. Anthropic puts both efforts into a single initiative, betting that AI models are good at reading code and finding bugs in it.

The partners' roles look like this: CrowdStrike and Palo Alto Networks are companies with experience in threat detection and incident response. They bring expertise in sectors where Anthropic itself has no operational experience of its own. The initial reports do not disclose how tasks will be divided among the participants.

What We Know About the Scanner

The scanner works on open projects automatically and for free. The key parameters that could be confirmed:

• Program name: Cyber Mission.
• Partners: CrowdStrike, Palo Alto Networks.
• Targets: critical infrastructure (power grids, water supply) and open-source projects.
• Cost of the open-source scanner: free.
• Expected vulnerability detection accuracy: above 90%.

The word "expected" matters here. This is not the result of an independent test but a target stated at launch. It is unknown what dataset the evaluation used. It is also unclear what exactly counts as accuracy: the share of real vulnerabilities found, or the share of correct detections among everything flagged. For a code scanner, that is a fundamental difference. Maintainers will quickly switch off a tool that finds nearly everything but drowns them in false alarms.

The model the scanner is built on has not been named either. Access terms, limits on repository size, and the process for disclosing discovered vulnerabilities are also not yet described.

Why False Positives Decide Everything

For open-source projects, the main shortage is human time, not tools. Someone has to read, reproduce, and close every scanner report. Even at 90% accuracy, a large codebase will still leave dozens of questionable findings. If the model accompanies each finding with a clear description, an exploitation example, and a suggested fix, the scanner will save hours. If it issues generic warnings, it will add to the workload.

The second question is responsibility for disclosure. Automated vulnerability discovery is equally useful to defenders and attackers. How Anthropic will handle discovered vulnerabilities before patches ship will become clear from how the program operates in practice.

How to Approach the Tool in Practice

Maintainers of open-source projects would be wise to run the scanner on a single non-critical repository and compare the output with their own list of known issues and with the output of their usual static analyzers. That way they can gauge the false-positive rate before building it into CI.

Security teams at companies that depend on open source should check which of their key dependencies will fall under the scan and ask Anthropic for the methodology behind the stated 90%. Infrastructure operators are better off waiting for a description of exactly which services the partners will provide under the program. For now, this is a statement of intent with one concrete number, and that number will have to be tested on real code.