Anthropic's Cyber Mission targets the months between finding a bug and fixing it

The design starts from Anthropic's own post-mortem. According to a dev.to breakdown of the announcement, Anthropic says Project Glasswing found many vulnerabilities, and concedes that it did not cut cyber risk enough ^[13]. Under Glasswing, months often passed between a bug being found and being fixed ^[2]. The slow steps it names are triage, prioritization and patching. All three still depend on people ^[3].

The infrastructure program goes after those steps directly. Operational technology in grids and water systems often cannot be taken offline to patch, so known vulnerabilities stay open for years ^[4]. That equipment is proprietary, changes to it are risky, and a mistake can take down a plant ^[18]. The hard decision is which fix to apply to a running system. Anthropic is putting models and on-site engineers inside the firms that already make that decision for utilities, and it is working through those firms' existing relationships instead of selling to utilities itself ^[5][7]. I think vendors are the right channel for this work, because they already hold the service contracts and the equipment knowledge. The founding list names 11 companies ^[19]. Four are OT specialists: Dragos, Nozomi Networks, Rockwell Automation and Hitachi ^[6]. The program extends a June effort for US state, local, tribal and territorial governments that has reached more than half of US states ^[8].

The open-source half is a different tool. OSS Scanner is modeled on Google's OSS-Fuzz, with model-driven discovery in place of fuzzing ^[10]. It finds bugs. Each report does carry a proof of concept and, where one exists, a suggested fix ^[9], so some of the patch work arrives with the finding. Reports go out without human review, and Anthropic says it expects a true-positive rate above 90% ^[11]. At that floor, one report in ten is wrong ^[20]. Separating that one from the other nine is triage, the step Anthropic calls the bottleneck. On most projects the job falls to small volunteer teams with no security budget, the breakdown says ^[22]. Anthropic handles this by scoping. Limiting the scanner to projects that can keep up is good engineering, and it was stated up front. Projects without that capacity keep getting human-verified reports through Anthropic's coordinated vulnerability disclosure process ^[12].

For a maintainer, the direct offers are scanner enrolment and a free Claude Max subscription. Maintainers have to apply to Claude for Open Source for the subscription ^[17]. The rest of the money goes through foundations. Anthropic names four it has funded: the Python Software Foundation, the Apache Software Foundation, Alpha-Omega, and OpenSSF, by way of the Linux Foundation ^[15]. The Defender Advantage Fund, launched in August, backs pilot programs and pays to keep OSS Scanner free ^[16]. The breakdown does not give dollar amounts for any of these grants. Security professionals who qualify for the expanded Cyber Verification Program, which now includes Glasswing, get more capable models with reduced blocking classifiers for defensive work ^[14].

Anthropic forecasts that within two years AI will favor defense ^[21]. As described so far, infrastructure operators get help with fixes through 11 partner firms ^[19]. Open-source projects get a suggested patch attached to a model-written report ^[9].