Anthropic launches OSS Scanner and a Critical Infrastructure Defense Program
OSS Scanner audits open-source code for free with unreviewed AI findings. Meanwhile, Anthropic's Critical Infrastructure Defense Program brings models and on-site engineers to OT defenders, starting with US partners.
What happened
Summary of reporting by The VergeOn 8 October, Anthropic announced the Anthropic Cyber Mission. The long-term programme splits into two tracks. The first is open-source security through OSS Scanner. This free, opt-in service lets Anthropic's frontier models run recurring security analysis on open-source repositories. It delivers reports and proposed patches directly to project maintainers. The second track targets critical infrastructure. The Critical Infrastructure Defense Program (CIDP) offers frontier Claude models, threat intelligence and on-site engineers to defenders of operational technology in power, water, transport and government systems. Founding partners include Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
Mechanically, OSS Scanner runs inside the enrolled project's own GitHub Actions workflows. It does not run on Anthropic's infrastructure. Scans run weekly on Fridays at 02:00 UTC. Anthropic covers model and compute costs. Organisations can enrol up to seven repositories. Concurrency caps at 20 GitHub Actions jobs per organisation due to runner quotas. Projects select either report-only mode or full remediation. In remediation mode, the agent opens pull requests labelled oss-scanner-automated-pr. The tool discloses pre-existing findings privately to project contacts before creating any public issue.
The release also expanded Anthropic's Cyber Verification Program. The tiers cover Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 across Defense Access, Red Team Access, and Specialized Access. The US government jointly reviews the Specialized tier. Anthropic noted that its June government programme now covers more than half of US states. Independent reporting highlights that findings are entirely machine-generated. Anthropic staff do not review them before publication. As a result, the project README warns that reports may be inaccurate. Enrolment also grants the agent broad repository write permissions. Original reporting: The Verge; Anthropic; Axios via Techmeme.
The Azrty take
Free AI audits commoditise the scan; the value moves to triage, permissions and the pipeline you control.
Here is the business reading. Anthropic just gave away the cheap part of application security: running scanners. It kept the real bottleneck: the models and the tooling. For GCC banks, telcos, utilities and government platforms, the direct impact is immediate. The open-source packages you run will soon accumulate public, AI-generated security issues and pull requests. If your teams lack the staff to triage them, genuine vulnerabilities will drown in plausible noise. Do not mistake CIDP for a service you can readily buy in Dubai or Riyadh. It is an alliance programme built around CrowdStrike, Dragos, Nozomi Networks, Rockwell Automation and major US integrators. Anthropic's Cyber Verification Program explicitly screens for legal jurisdiction, diversion risk and compelled access. The US government jointly reviews Specialized Access applications. Several regional entities will fail that filter. For UAE and Saudi operators, the realistic path is simple. You must run equivalent capabilities on infrastructure you control.
The underlying capability is material. You cannot ignore it. The CyberGym benchmark tested 1,507 real OSS-Fuzz vulnerabilities across 188 projects. The top pairing, OpenHands with Claude Sonnet 4, resolved only 17.9% of tasks. Yet that same harness later discovered 34 zero-days and 18 incomplete patches. Anthropic's Claude Mythos 5.1 page prices that capability tier at $10 per million input tokens and $50 per million output tokens for verified defenders. Meanwhile, the OSS Scanner repository shows what enrolment requires. It allows seven repositories per organisation, 20 concurrent Actions jobs, and weekly runs on Fridays at 02:00 UTC. It uses GHSA-prefixed issue titles and demands a CODEOWNERS wildcard for @anthropics/oss-scanner-automation.
Most engineering organisations will stumble in two places. First, they will treat machine findings as ground truth. The README itself warns that reports may be inaccurate. Second, teams will treat an autonomous agent with ruleset write access as a normal auditing tool. It is not. It is an untrusted, highly privileged workload. Issue bodies, READMEs and git commits are attacker-controlled text. An automated triage agent that parses them without strict sandboxing is vulnerable to prompt injection. An agent configured to bypass branch protection rules is just a backdoor with a vendor logo. The second failure mode is waiting. GCC operators cannot afford to wait for US-centric programmes to cover Gulf infrastructure. You need defensive automation running internally today.
Azrty approaches this architecture with a strict hierarchy. Run deterministic static analysers first. Run AI inference second. Require human engineering sign-off always. We trigger CodeQL, container image scans and dependency checks on scheduled runs. An LLM agent then triages findings and drafts remediation patches behind a managed model gateway. Our FastLLM Proxy controls access, routing and per-repository spend across internal and external models. Every agent action passes through orchestration gates such as Dhole. Strict test suites ensure unverified code never merges (Procoder). Verified findings feed into a central queue without duplicate noise, following the pattern of Kuvryn Scout. Per the CodeQL CLI documentation, the deterministic engine creates structured SARIF files before any AI triage begins:
codeql database create codeql-dbs --source-root=src --db-cluster \
--language=java,python --command=./build.sh
codeql database analyze codeql-dbs codeql/java-python-code-scanning.qls \
--format=sarif-latest --sarif-category=java-python --output=results.sarif
codeql github upload-results --repository=my-org/example-repo \
--ref=refs/heads/main --commit=$(git rev-parse HEAD) --sarif=results.sarif
Early movers in the UAE and GCC win by proving their software supply chain security. Regulators and auditors will ask who reviews your open-source dependencies. They will ask what technical checks you run. You need to show an automated pipeline, an auditable queue and an SLA. Vendor press releases will not satisfy them. Treat Anthropic's announcement as an architectural prompt, not a turnkey product. That approach lets you build software supply chains that satisfy regional sovereign data rules and pass strict security audits.
What to do now
- Deploy a deterministic security baseline across your top five production repositories this month. Install the CodeQL CLI, run local database builds and analysis, and pipe SARIF alerts into GitHub code scanning or your internal SIEM. Do this before sending raw code to generative models.
- If your teams maintain public open-source projects, enrol up to seven repositories via github.com/anthropics/oss-scanner. Start in report-only mode. Assign an on-call engineer to review the weekly reports delivered on Fridays at 02:00 UTC.
- Critical-infrastructure and OT security leaders should apply to Anthropic's Cyber Verification Program (Defense Access tier) to assess access windows. At the same time, design and budget self-hosted agentic auditing pipelines on regional private cloud infrastructure.
- Lock down agent privileges before enabling automated security tooling. Require explicit human CODEOWNER sign-off on pull requests labelled `oss-scanner-automated-pr`. Revoke bypass permissions on branch protection rulesets. Enforce token quotas at your gateway (such as FastLLM Proxy) to stop run-away spend and denial-of-service loops.