Anthropic launches cyber mission to defend infrastructure and open-source code

Anthropic announced the launch of the Anthropic Cyber Mission, a new initiative designed to help organizations defend against artificial intelligence-driven cyber threats. According to the company, attackers currently hold a distinct advantage, a situation Anthropic expects to persist for the next two years. The effort aims to level the playing field by providing defenders with access to the same advanced tools that malicious actors are already utilizing.

The initiative focuses on two primary areas: protecting critical infrastructure and securing open-source software. Anthropic stated that it wants to give defenders access to the tools attackers are already using, rather than leaving security teams to guess at emerging AI capabilities. This approach acknowledges the growing sophistication of AI coding agents while emphasizing the continued necessity of human expertise in complex security environments.

Critical Infrastructure Defense Program

The first pillar of the mission is the Critical Infrastructure Defense Program. This component combines Anthropic’s most advanced AI models with on-site engineers, sometimes referred to as forward deployed engineers, to assist organizations lacking in-house machine learning talent. The program aims to prevent attackers from using AI to exploit zero-day vulnerabilities in systems such as SCADA networks that control public utilities.

Anthropic is collaborating with a wide range of partners to execute this program. The partner list includes Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. These organizations have existing ties to critical infrastructure sectors and are already working to safeguard technical frameworks that are constantly probed by AI agents.

Open Source Security Scanning

The second focus area involves a service called OSS Scanner, which provides regular security scans from Anthropic’s strongest models to open-source projects. The company describes this service as free, but eligibility is restricted. Anthropic has adopted the same criteria used by Google for its OS-FUZZ project, limiting participation to established projects that have a critical impact on infrastructure and user security.

This means the offer does not extend to all open-source repositories. Only those deemed to have significant critical impact will receive these scans. Anthropic insists this targeted approach is necessary to provide meaningful defense capabilities where they are most needed, rather than spreading resources thinly across the entire open-source ecosystem.

What should you do?

Security professionals should evaluate whether their organization falls under the critical infrastructure category or maintains eligible open-source projects. Those who do may seek out the partner network listed by Anthropic to explore the Critical Infrastructure Defense Program. For other organizations, monitoring the development of AI-assisted attack vectors remains essential, as Anthropic warns attackers retain the advantage for the foreseeable future.

What to do and how to stay safe: Anthropic

• Determine if your organization qualifies as critical infrastructure or maintains eligible open-source projects.
• Review the list of Anthropic partners to identify potential collaborators for defense programs.
• Monitor for new AI-driven attack techniques, as attackers currently hold the advantage.
• Ensure internal security teams are trained to work alongside AI tools and human experts.

Step-by-step guide: Prompt Injection Warning Signs: How to Spot AI Manipulation

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Who is eligible for the OSS Scanner service?

Only established open-source projects with a critical impact on infrastructure and user security are eligible, mirroring Google's OS-FUZZ criteria.

Which companies are partnering with Anthropic?

Partners include Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.

How long will attackers have the advantage?

Anthropic states that attackers will hold the advantage for the next two years.