Anthropic's free OSS Scanner: who audits the auditor?
On Oct 8, 2026, Anthropic launched two free arrangements under the name Anthropic Cyber Mission: the Critical Infrastructure Defense Program (CIDP), which puts frontier Claude models, embedded engineers and threat research behind 11 founding partners including Accenture, CrowdStrike, Deloitte, Palo Alto Networks, PwC and Rockwell Automation to protect power-grid, water and transport OT systems; and OSS Scanner, a free opt-in service using Anthropic's strongest models, including Claude Mythos, to scan open-source projects. The piece says the models found over 29,000 candidate vulnerabilities in six months, with only about 6,000 human-reviewed and nearly 5,000 unverified reports plus candidate patches sent straight to maintainers, and that fast-track findings are neither subject to a 90-day disclosure window nor published. It argues the structural problem is one company being model vendor, open-source auditor, critical-infrastructure gatekeeper and arbiter of what counts as a vulnerability, citing VulnCheck's September comparison in which Claude rated 91.5% of findings high or critical versus maintainers' 51.3%.
Free scanning concentrates vulnerability judgement inside one vendor, shifting where open-source and critical-infrastructure security trust is anchored.
（本文作者为 穷奇观察，钛媒体经授权发布）
文 | 穷奇观察
2026 年 10 月 8 日，Anthropic 一天之内推出两项“免费”安排。
第一项叫“关键基础设施防御计划”（Critical Infrastructure Defense Program，CIDP）。前沿 Claude 模型、驻场工程师和威胁研究，交给 11 家创始伙伴：埃森哲、博思艾伦、CrowdStrike、德勤、Dragos、日立、Insane Cyber、Nozomi Networks、Palo Alto Networks、普华永道、罗克韦尔自动化。
这些伙伴服务的对象，是电网、水务、交通网络，以及政府系统背后的运营技术（OT）。
第二项叫 OSS Scanner。免费、自愿接入，用 Anthropic 最强的模型（包括 Claude Mythos）给开源项目做定期安全扫描。
#Anthropic#Claude#OSS Scanner#Critical Infrastructure Defense Program#Claude Mythos#Claude Security#VulnCheck#Project Glasswing#CrowdStrike#Palo Alto Networks#curl#OpenSSL