Anthropic launched its Cyber Mission on October 8, pairing support for critical-infrastructure defenders with a security-scanning service for open-source projects. The announcement described OSS Scanner as a way for participating projects to receive regular scans from the company's models at no charge.

The infrastructure work begins with operational technology in areas such as electricity, water, and transportation. Anthropic said its Critical Infrastructure Defense Program would supply models, on-site engineering, and threat research.

The dedicated OSS Scanner announcement says its output is fully model-generated, without human triage. Reports include a self-contained reproducer and explanation, plus a candidate patch when available. That places the validation work with the receiving maintainer.

Anthropic says earlier scanning found more than 29,000 candidate vulnerabilities, of which roughly 6,000 had been manually reviewed. Those are different populations. Treating the larger candidate total as a count of confirmed vulnerabilities would overstate the published evidence. The opt-in service is intended to deliver findings faster while the existing coordinated process continues for human-verified reports.

A plausible report still needs someone to reproduce the issue, determine which versions are affected, and decide whether the proposed patch changes expected behavior.

A generated patch can help that process without settling it. Maintainers still need to review the code, run the project's checks, and arrange a release. Users need to know which fixed version to install.

A scan covers the code and conditions it can examine. It cannot establish that a project has no other weaknesses or that every dependency in a deployed application received the same review.

What a downstream team needs

  • The affected project and version range.
  • A way to reproduce or understand the validated issue.
  • The release containing the reviewed repair.
  • The project's own advisory or update instructions.

Downstream teams need to check the version their application is running against the project's own advisory and fixed release. Participation in the scanner service does not establish that a deployed version has been repaired.