Anthropic expands its cyber push with 11 critical-infrastructure partners

Anthropic is expanding its cybersecurity work beyond open-source scans, with an initial group of 11 providers supporting organisations that defend critical infrastructure. The company says its models have identified tens of thousands of potential software vulnerabilities, but the figures also show why AI findings still need careful handling.

Anthropic Watch analysis

What happened

Anthropic’s Cyber Mission combines its free, opt-in OSS Scanner with a programme to support providers defending infrastructure such as power, water, transport and government systems. The company says the new programme will initially work through 11 partners, including CrowdStrike, Dragos, Rockwell Automation and Accenture. It plans to use this first group to test which approaches work before expanding to more partners and sectors.

Anthropic says its models identified more than 29,000 candidate vulnerabilities in widely used software over six months. Its team manually assessed about 6,000, while nearly 5,000 reports were sent to maintainers who requested all available findings, including unvalidated ones. The company says the scanner’s regular reports can include explanations, reproducible evidence and proposed fixes where available. Projects must apply, and Anthropic says eligibility will focus on software important to infrastructure and user security. Read EdTech Innovation Hub’s report.

Why it matters

The scale is striking, but so is the gap between candidates detected and findings reviewed. Anthropic says expert testers examined 97 high- or critical-severity findings from an early scanner version across 48 projects: 85 met its standard for coordinated disclosure. Of the remaining 12, the company says 11 were genuine issues that duplicated known problems or other findings, and one was invalid. Those results concern a selected group of severe findings, not every report the scanner produces.

For maintainers, faster detection is useful only if there is enough capacity to assess and act on the reports. Anthropic says the unreviewed scanner is intended for projects able to investigate its findings, while its existing human-verified process will continue, particularly for projects without those resources. That division matters. A security report is an invitation to investigate, not a verdict delivered by machine.

Our read

This is a substantial push to apply AI-assisted security work to both open-source software and critical infrastructure. The numbers make the case for potential scale, not for treating every alert as a confirmed flaw. Anthropic’s own account points to the practical test: whether partners and maintainers can turn promising findings into verified fixes without being buried in noise.

What to watch

• Whether Anthropic publishes results from the critical-infrastructure programme as it expands.
• How many scanner reports lead to verified, distinct vulnerabilities and fixes.
• Whether projects with fewer security resources can get support to assess findings.

Discussion spark: Should AI-generated vulnerability reports be sent to maintainers before human validation, if that brings findings sooner but leaves more triage work to projects?

Anthropic Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by Anthropic.