The security firms that utilities and plant operators already hire can now use Anthropic’s most powerful AI models to find and fix weaknesses in the equipment that runs power, water, and transportation.
Anthropic launched the Anthropic Cyber Mission, a long-term effort to protect what it calls “the systems everyone depends on.” The effort starts in two areas: the equipment that runs power grids, water systems, and transportation networks, and the free, shared open-source code that most software is built from.
For the equipment, Anthropic created the Critical Infrastructure Defense Program. It gives the cybersecurity companies that serve utilities and plant operators access to Anthropic’s most powerful AI models and its research on how attackers operate. Anthropic is also sending its own engineers to work on-site. For open-source code, Anthropic launched OSS Scanner, a free service that scans open-source projects for security flaws.
Utilities and plant operators rely on outside security firms
The computer controllers, software, and networks that run power grids, water utilities, factories, and transit networks are built to last for decades. They often cannot be shut down for a fix, so known security flaws can stay open for years. A mistake while making a fix can shut a plant down.
Anthropic said operators of all sizes rely on a small group of trusted outside providers to identify weak points attackers could exploit and to apply fixes while the equipment keeps running. The new program works through those providers.
Consulting firms, security companies, and equipment makers are the program’s first partners
The 11 founding partners include consulting firms that run security programs, security companies that guard business and industrial networks, and manufacturers that build and patch the equipment. The inaugural partners are Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation.
Anthropic said several partners already use its Claude models to fix security flaws and help their customers do the same. It is starting with a small group to learn which approaches work. Other companies that build security products or services for critical infrastructure can register their interest.
Anthropic says defenders have not kept up with attackers
Anthropic said AI models that can find and exploit security flaws are “widely available to attackers now,” but defensive tools “have not yet reached enough of the defenders who need them.” It also said government-backed hackers have spent years gaining access to power, water, and other essential systems so they can disrupt them later.
According to Anthropic, finding flaws has become easy, but confirming them, deciding which to fix first, and fixing them still takes time and human effort. In Project Glasswing, Anthropic’s program that lets approved organizations use its most powerful models to find and fix flaws, Anthropic often saw months pass between finding a flaw and fixing it. For industrial equipment, a fix may have to wait until it can be applied safely to running machinery, which in rare cases could take decades.
The Cyber Mission continues Anthropic’s effort to give its AI security tools to more organizations
The Cyber Mission is the latest in a series of Anthropic moves to give defensive AI tools to more organizations and to provide support, in its words, “where it’s most needed.”
In April, Anthropic launched Project Glasswing with about 50 large technology companies, and in June it added about 150 more organizations, including power, water, and healthcare companies. In June, Anthropic also launched a cyber defense program for state, local, tribal, and territorial governments. It gives them access to its most powerful Claude models and technical help to find and fix code flaws, respond to attacks, and test their defenses. Anthropic says the program has since reached more than half of U.S. states. On Oct. 6, Anthropic opened Glasswing to smaller security firms, open-source project managers, and individual researchers.
Anthropic also said it funded the organizations behind widely used open-source code, including the Python Software Foundation and the Apache Software Foundation. In August, it was among more than 150 organizations that signed a letter calling on AI companies and governments to help hospitals, water utilities, local governments, and other essential services first.
Anthropic plans to bring the infrastructure program to more partners and sectors
Over the coming months, Anthropic said it will bring the Critical Infrastructure Defense Program to more partners and sectors and share what it learns, including what didn’t work. It said it expects other AI developers, security companies, and governments to run their own efforts, and that it wants to work with them.
