Claude Joins the Cyber Defense Crew: Anthropic Takes Aim at Power Grids and Open Source

The most meaningful AI breakthroughs may not always arrive with a dazzling demo. Sometimes, they show up as better tools for the people keeping water flowing, electricity running and software dependable. On October 8, Anthropic announced its Cyber Mission, a long-term effort initially focused on critical infrastructure and open-source software. At GlobalGraph, we feel the promising story here is resilience: putting advanced AI alongside experienced defenders, with the aim of making essential systems harder to compromise. The infrastructure centerpiece is the Critical Infrastructure Defense Program, which will bring frontier Claude models, on-site engineers and threat research to companies already trusted to secure industrial environments. Its 11 founding partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic says several partners are already working with Claude to address vulnerabilities and help customers do the same. That delivery model matters: the company is working through established specialists rather than treating a general-purpose model as a substitute for operational expertise. Industrial cybersecurity operates under constraints that make ordinary software maintenance look comparatively straightforward. Power grids, water utilities, factories and transportation networks depend on operational technology—controllers, control software and industrial networks often designed to run for decades. Taking equipment offline or applying an inadequately tested change can interrupt essential services. Anthropic acknowledges that AI cannot solve every difficulty in these environments and says its initial partner cohort will help establish which approaches are practical. At GlobalGraph, we feel that recognition of real-world limits makes the initiative more credible, not less ambitious. The second launch, OSS Scanner, addresses a different part of the same dependency chain: the shared code underlying much of modern software. The free, opt-in service gives participating open-source projects periodic scans using Anthropic’s most capable models. Reports include an explanation of a suspected vulnerability, a proof of concept showing how it could be exploited and a suggested fix where available. Cybersecurity News also reported the scanner’s introduction on October 9, highlighting its role in checking critical open-source repositories. For maintainers equipped to process the findings, the opportunity is to receive actionable leads without paying for the scanning service. Speed comes with an important qualification: OSS Scanner’s reports reach maintainers without human review. Anthropic expects a true-positive rate above 90%, but that is a company expectation, not an independently established result in the supplied reporting. Findings can still contain inaccuracies, including incorrect severity ratings. The service is intended for projects able to keep up with incoming reports; Anthropic says it will continue providing human-verified disclosures to other projects through its coordinated vulnerability disclosure process. At GlobalGraph, we feel this distinction is essential: faster discovery becomes useful when maintainers also have the capacity to evaluate and act on it. That maintenance challenge is a central lesson from Project Glasswing, Anthropic’s earlier security effort. According to the company, partners uncovered many vulnerabilities, yet verifying, prioritizing and repairing them remained difficult; months could pass between discovery and a fix. Glasswing has now been merged into the expanded Cyber Verification Program, while the Cyber Mission adds engineering support, tools and funding for infrastructure and open-source defenders. Anthropic also identifies longer-term goals for its open-source work, including faster delivery of findings, automated triage and patching for interested projects, and research into more secure architectures and coding practices. The initiative still has questions to answer. Axios notes that the announcement does not establish how participating companies will safely test and deploy fixes without disrupting utility operations. It also leaves unspecified whether infrastructure partners receive free model access or who pays the associated computing costs—a separate issue from OSS Scanner’s explicitly free service. Those details will help determine how broadly the program can deliver value. Anthropic says it plans to expand participation and share lessons, including approaches that fail, providing a useful basis for judging progress beyond the launch announcement. Anthropic forecasts that AI will favor cyber defense within two years, while acknowledging that the near-term balance is less certain. That forecast remains a prediction, not a demonstrated outcome. Still, at GlobalGraph, we feel the constructive opportunity is clear: combine capable models with trusted security providers and open-source maintainers, then focus on completing the work between finding a weakness and repairing it safely. The Cyber Mission’s eventual significance will rest less on the volume of bugs discovered than on whether essential services keep running and the software beneath them becomes more secure.