Anthropic Launches Cyber Mission: 11 Partners to Defend Power Grids and Open Source

On October 8, 2026, Anthropic announced Anthropic Cyber Mission, a long-term program in which the company gives defenders tools, research and resources to harden software and industrial systems. It starts with two tracks. The first is the Critical Infrastructure Defense Program (CIDP) with 11 founding partners. It provides frontier Claude models, field engineers and threat intelligence to those who defend power grids, water systems and transport. The second is OSS Scanner: free, regular security scans of open-source projects by Anthropic's strongest models.

Operational technology: a patch means a shutdown

Controllers, control software and industrial networks in energy, water supply, factories and transport are built to run for decades. These systems are known as operational technology (OT), and taking them offline for an update is often impossible. Known vulnerabilities stay open for years. The equipment is proprietary, any change carries risk, and a single mistake can halt an entire facility.

Operators of every size depend on a small circle of trusted providers, who tell them what is vulnerable and which fixes can be applied to a live system. CIDP targets exactly these providers. The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. They include consulting and technology firms that build security programs, vendors that protect corporate and industrial networks, and manufacturers that make and patch the equipment itself.

Anthropic stresses that critical infrastructure is hard to defend for many reasons that AI will not solve. Its bet is different: frontier models will help find and fix weak points before anyone exploits them to cut power or make water unsafe. Several partners already work with Claude to fix vulnerabilities and help their customers do the same. The first phase is a small cohort of providers, and the company wants to use it to learn which strategies actually work in practice.

OSS Scanner and lessons from Project Glasswing

The second track covers free, shared code, which underpins most software. OSS Scanner will look for vulnerabilities, propose patches and help harden foundational code. Projects receive regular scans for free.

The launch builds on the experience of Project Glasswing. According to Anthropic, partners found many vulnerabilities through Glasswing but did not achieve a sufficient reduction in cyber risk. Finding holes has become easier than ever. Verifying, ranking and closing them is harder. The company acknowledges that defenders of critical infrastructure and open source have decades of experience but are short on resources, and that the current moment makes the shortage worse. Against this backdrop, Glasswing was folded this week into an expanded Cyber Verification Program, which opens access to the most powerful models for a noticeably larger number of defenders.

The reason for the launch is stated bluntly: frontier models can be used to exploit vulnerabilities and run cyber operations, and state-backed groups have spent years entrenching themselves in systems across industries so they can disrupt them if needed.

Key details

• Launch date: October 8, 2026.
• Tracks: critical infrastructure and open-source software, with a promise to expand into new areas.
• CIDP: Claude models, Anthropic field engineers, threat research.
• CIDP partners: 11 companies, from Accenture and Deloitte to Dragos, Nozomi Networks and Rockwell Automation.
• OSS Scanner: regular security scans by the strongest models, free for open-source projects.
• Glasswing: merged with the Cyber Verification Program.

Who should do what

If your company builds security products or services for critical infrastructure, Anthropic invites you to register interest in CIDP. The first cohort is small, so do not count on quick access. Open-source maintainers should watch for OSS Scanner terms: the available part of the announcement does not disclose selection criteria, scan volumes or the size of funding.

The main practical takeaway for security teams: as vulnerability discovery gets cheaper, the fixing process becomes the bottleneck. Decide in advance who will verify the model's findings, what criteria to use to prioritize them, and how to ship patches to systems that cannot be stopped. Anthropic names these questions as the main lesson of Glasswing, and they are what will decide whether the program worked.