Anthropic launches Cyber Mission for power grids, water systems and open-source code

Anthropic announced the Anthropic Cyber Mission on 8 October 2026, which it calls a long-term commitment to securing the systems everyone depends on. The company says it will supply tools, research and engineering talent to defenders, starting with critical infrastructure and open-source software.[1]

The announcement is a programme launch, not a security result. Anthropic reports no figure for vulnerabilities fixed under either programme, and says the work with partners is underway. It also says finding bugs is easier than ever, while verifying and fixing them remains hard.[1]

Anthropic's focus is operational technology, the controllers, control software and industrial networks behind power grids, water utilities, factories and transport. It says these systems are built to last for decades and often cannot be taken offline to patch, so known weaknesses can stay unresolved for years.[1]

The Critical Infrastructure Defense Program supplies frontier Claude models, on-site Anthropic engineers and threat research. It does not go to operators directly. It goes to the providers operators rely on, who tell them what is exposed and which fixes to apply on a running system.[1]

The founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several are already using Claude to fix vulnerabilities and help customers do the same.[1]

The first step is a small cohort, so the company can learn which strategies are practical. A provider that builds security products or services for critical infrastructure can register interest through a form. Anthropic does not say how many partners it will accept or what the programme costs.[1]

OSS Scanner is an opt-in service inspired by Google's OSS-Fuzz. Enrolled projects receive periodic scans from Anthropic's strongest models, free of charge. Each report contains a proof of concept showing how a bug could be exploited, an explanation, and a suggested fix where one exists.[1]

Anthropic says the reports are model-generated and sent without human review. Maintainers get them faster, but some will contain errors such as a wrong severity rating. The company expects a true-positive rate above 90 per cent. That figure is an expectation, not a measured result.[1]

Malaysia's National Cyber Security Agency (NACSA) implements the Cyber Security Act 2024, which came into operation on 26 August 2024. NACSA's page says the Act covers national critical information infrastructure sector leads and entities, and licenses cyber security service providers. The page does not mention AI.[2]

Anthropic's announcement does not mention Malaysia or NACSA, and it does not say whether a Malaysian provider could join the infrastructure programme. Our reading is that operators should ask their own providers about AI use now, because the Act's duties apply regardless of which tools the provider chooses.[1][2]