← Back to feed

Anthropic launched its Critical Infrastructure Defense Program on October 8, 2026, deploying frontier Claude models alongside on-site engineers and threat research at companies responsible for securing power grids, water utilities, and other critical infrastructure systems.

The program launched with 11 founding partners: Accenture, Booz Allen Hamilton, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. Participating companies use Anthropic’s resources to identify and fix vulnerabilities in their customers’ systems. Anthropic said several founding partners are already using Claude to remediate vulnerabilities.

Why Now

Critical infrastructure operators run complex, aging systems. AI has made attacks faster and cheaper to execute — and defenders need access to comparable capabilities. Anthropic and OpenAI have separately pursued vetted programs to put frontier models in the hands of cybersecurity operators. Anthropic’s earlier Project Glasswing provided frontier access to a small set of vetted organizations to find security vulnerabilities; the Critical Infrastructure Defense Program scales that model with a broader partner network and dedicated on-site staffing.

OpenAI launched GPT-5.4-Cyber in April 2026 with a similar framing, giving thousands of vetted defenders access to a specialized model. The new Anthropic program adds a physical component — on-site engineers — that OpenAI’s initiative did not include.

OSS Scanner

Alongside the partner program, Anthropic is launching OSS Scanner: a free service that runs periodic Claude vulnerability scans on open-source software projects and sends automated reports to maintainers.

Reports describe discovered vulnerabilities, how they could be exploited, and suggested fixes. Anthropic disclosed that OSS Scanner reports do not undergo human review before delivery, meaning some findings could be inaccurate. The tradeoff is speed and scale: automated scanning can cover more projects more often than a human-gated process.

Anthropic published validation numbers at launch: an internal audit of 97 high- and critical-severity findings produced 85 valid issues, 11 duplicates, and 1 invalid finding (false positive), for an expected true-positive rate above 90%. Even so, open-source maintainers who receive automated reports must spend time triaging findings. Anthropic has not detailed how OSS Scanner will handle disputes for the edge cases that do not meet that bar.

Stakes

Power grids, water systems, and industrial control networks represent the highest-consequence category of cyberattack targets. Regulatory bodies in the U.S. and Europe have been pushing critical infrastructure operators to modernize their security posture, but the complexity and age of OT systems make patching slow and risky. AI-assisted vulnerability scanning could compress discovery timelines substantially, provided the models are calibrated well enough to reduce triage burden rather than increase it.

The partner lineup spans advisory firms (Accenture, Deloitte, PwC, Booz Allen), cybersecurity specialists (CrowdStrike, Nozomi, Dragos, Palo Alto Networks, Insane Cyber), and industrial OT vendors (Hitachi, Rockwell Automation), covering the full stack from policy to the plant floor.