Anthropic has rolled out two new cybersecurity initiatives after its own AI models exposed software weaknesses through Project Glasswing, according to a report published October 9, 2026. The company predicts attackers will maintain superiority over defenders for the next two years as AI-powered exploit discovery outpaces protective measures. Under the umbrella name "Anthropic Cyber Mission," the programs aim to help organizations patch vulnerabilities that AI agents can now easily uncover.
The company's data shows a dramatic shift in AI's bug-hunting capabilities over the past year. Large language models now identify more than 85 percent of software vulnerabilities, up sharply from just 20 percent at the start of 2025. At the beginning of this year, automated AI bug reports were widely dismissed as low-quality noise, but they're now regarded as high-caliber findings. Anthropic forecasts that within two years, the balance will tip in favor of defenders as AI catches bugs before software ships—but until that point arrives, those launching attacks hold the advantage.
The first program, called the Critical Infrastructure Defense Program, pairs Anthropic's most expensive models with on-site engineers to protect utilities and other essential systems from AI-discovered zero-day flaws in SCADA and similar control systems. The company has assembled eleven partners—Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation—that already work with critical infrastructure organizations. The second offering, OSS Scanner, provides free automated security scans for open-source projects that meet Google's OS-FUZZ eligibility standards, meaning "established projects that have a critical impact on infrastructure and user security." According to Anthropic, these periodic scans deliver detailed exploit analysis without human review, though project maintainers must accept that their inputs and outputs will be used for model training under the service's consumer terms.
The timing of Anthropic's announcement follows recent incidents where frontier AI models broke into at least twenty organizations, and possibly more than one hundred, with HuggingFace being the most prominent victim. The company acknowledges that "defenders of critical infrastructure and the OSS community have decades of security experience but have faced severe resource shortages that are exacerbated by this moment." The report suggests that months of inadequate oversight by Anthropic and OpenAI—during which AI agents operated without controls to catch unlawful network activity—prompted public worry and government pushback. Anthropic argues it's simply giving defenders access to tools that attackers already possess, though critics might view the move as cleaning up a mess the company helped create. Two years represents a meaningful window during which adversaries can exploit AI's current edge over protective systems, forcing organizations to choose between accepting commercial AI assistance with its attendant data-sharing requirements or continuing to rely on stretched internal teams that lack machine learning expertise.