Anthropic says its new open-source scanner should be right more than 90 percent of the time. That sounds great, right? Now think about the other side of that number. Because nobody reads those reports before they land in a maintainer’s inbox.
What Anthropic actually announced
On October 8, 2026, Anthropic launched the Anthropic Cyber Mission. The company calls it “a long-term commitment to securing the systems everyone depends on.” It starts in two places, so let’s look at both: critical infrastructure and open-source software.
The first piece is the Critical Infrastructure Defense Program. It gives trusted security providers frontier Claude models, on-site engineers, and Anthropic’s threat research. There are eleven founding partners. They are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.
The second piece is OSS Scanner. In plain English, it is a free service for open-source projects. Enrolled projects get periodic scans from Anthropic’s most capable models. Also, each report includes a proof of concept, an explanation, and a suggested fix where one exists.
Anthropic also says it has offered Claude models and technical support to more than half of US states since June. In addition, a fund called the Defender Advantage Fund, launched in August, helps keep OSS Scanner free. So this is a program with money and partners behind it, not a quick demo.
The line most coverage skips
Here is the sentence I want you to read twice. Anthropic writes: “The reports are model-generated and sent without human review.” The company also says it expects “a true-positive rate above 90%.” A true positive is a real bug that the scanner correctly flagged.
So what does that mean in practice? It means some findings will be wrong. However, Anthropic admits that some reports will contain inaccuracies, such as a wrong severity rating. In other words, a volunteer could get an urgent report about a flaw that is not urgent. It might not be real.
Scanning is now cheap. Still, checking is expensive. Anthropic has pushed the cost of finding bugs down. As a result, the cost of verifying them lands on the person who gets the report. That is the part I would watch.
The quiet problem with industrial systems
But the other half of the announcement deserves attention too. Anthropic points out that operational technology, or OT, often “cannot be taken offline to patch.” OT means the machines that run power grids, water systems, and transportation networks. As a result, known vulnerabilities can stay unresolved for years.
Therefore, consider this. Anthropic also says the cost of exploiting vulnerabilities has dropped. Its forecast is that in two years, AI will favor defense. Notice what that implies. For now, the advantage may still sit with attackers.
That is a candid forecast, and I appreciate it. After all, vendors rarely tell you the next two years may be rough. Still, it means your plan cannot assume the scanners fix everything on their own.
Why this matters to your organization
You probably do not maintain an open-source project. However, you almost certainly depend on dozens of them. Your vendors, your cloud tools, and your internal apps all pull in open-source code. When a scanner floods those projects with reports, a few things can happen.
First, real fixes may arrive faster. That is the good news. Second, your vendors may push more patches, and some will come with little warning. Third, a few maintainers may drown in reports and slow down. Meanwhile, your team still has to decide which patches matter.
This is a Security pillar issue, and it connects to the A.S.K. Framework. Automate the scanning and the patch tracking. Share the triage load with your vendors. But keep a human in charge of the severity call. A model’s rating is a starting point, not a verdict.
What to do this week
- Map your open-source dependencies. Ask your engineering team for a software bill of materials, or SBOM. That is simply an ingredient list for your software.
- Ask your key vendors one question. Are you enrolling in OSS Scanner, and how will you verify findings before you ship a patch?
- Set a triage rule. Decide who confirms a severity rating before anyone drops everything. A wrong rating should not trigger a fire drill.
- Check your industrial exposure. If you run OT, find out what cannot be taken offline and who owns the compensating controls.
- Budget for patch volume. More scanning means more fixes. Plan the people and the maintenance windows now.
- Track the claim. Anthropic expects AI to favor defense in about two years. Until then, assume attackers have the same tools.
Let’s talk before you need to
Think about your last big patch cycle. How many people touched it, and how long did it take? Now picture that volume doubling. Because that is the kind of pressure faster discovery can create.
The big story is not that AI can find bugs. We knew that. Instead, the story is who checks the work. Faster discovery is only a win if your organization can sort real from noisy, and fix what matters.
Don’t wait for a flood of patch alerts to become your emergency. Book a strategy call with me this week and let’s build your triage plan before the reports arrive.
And if you want more conversations like this one, listen to my podcast, OMG AI, on Spotify. We keep it honest and plain. What would you do if a scanner sent your team 200 reports tomorrow? Tell me in the comments.
Sources
- Anthropic: Introducing the Anthropic Cyber Mission
- Help Net Security: Anthropic offers free AI security scans to open-source maintainers
Photos: Andrew Hall (cover) and Christopher Gower on Unsplash.
Watch: related video