The short version. On 8 October 2026, Anthropic (the company that makes Claude) started something called the Cyber Mission. The idea: AI has become very good at spotting the weak points in software, so get those tools to the people defending it before the people attacking it. It begins with free checks for the shared code most websites are built on, and help for the companies that protect power, water and transport. If you own a website rather than build one, jump to what this means for you.
First, two words
A weak point (the industry says "vulnerability") is a mistake in software that someone can use to get in where they should not. Like a window left unlocked.
Open-source code is software written by volunteers and given away free, for anyone to use. Almost every website in the world is built partly from it, including yours. It is the bricks, not the building.
What happened
AI has got very good at reading software and spotting those weak points. That skill does not pick a side. Whoever points it at the code first gets the list first.
Anthropic's answer is the Cyber Mission, announced on 8 October 2026. It is a long-term effort to make sure the defenders get there first.
What I find interesting is how honest they are about the last attempt.
In an earlier project called Glasswing, partners checked hundreds of widely used open-source projects and quietly told the people who look after them what they found. Plenty of weak points turned up. Anthropic's own verdict is that this still has not made things safe enough.
The reason is worth understanding, because it is the whole story: finding the problem is now the easy part. Somebody still has to confirm it is real. Somebody still has to fix it. Both of those need people, and people are the thing there are not enough of.
What is in it
Help for power, water and transport
The Critical Infrastructure Defense Program gives its best AI models, its own engineers and its research to the companies that protect the systems behind electricity, water and transport.
The first partners include Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation.
Free checks for the shared code
OSS Scanner checks open-source projects regularly, for free, if they sign up. Each report comes with an explanation, proof that the problem is real, and a suggested fix where there is one.
The catch is stated plainly, which I respect: no human reads these reports before they are sent. Anthropic expects more than nine out of ten to be right, which also means some will be wrong, including being wrong about how serious something is. It is meant for projects with enough people to handle that. Smaller projects still get reports checked by a person first.
Alongside those sit a programme security teams can apply to for access to the models, free Claude subscriptions for open-source maintainers, and a fund that keeps the scanner free.
The shape of the problem
That picture is the whole thing. Finding is fast and cheap. Checking and fixing are not. Any plan that assumes the hard part is finding problems is solving the step that is already solved.
What this means if you own a website
Nothing on that list is something you sign up for. Your website is not a power station, and you are not looking after shared code. But there is one part of this that does affect you.
The same tools are available to whoever wants to look at your site. Checking a website for an old add-on with a known hole in it used to take some skill and some time. Now it takes neither. The gap between "a weak point exists" and "somebody knows about it" has closed, and it is not opening again.
Three questions to ask whoever looks after your website this week:
- When was it last updated? Not the words and pictures. The software behind them, and the add-ons. Most break-ins I have seen used something that had a fix available months earlier.
- Where is the backup kept? If it is on the same computer as the site, it is not a spare copy. Here is why that matters.
- Who would notice? Not who built it. Who would spot it, this month, if something changed.
Here is the reassuring part, and it is also the useful part. Even with the best AI in the world pointed at the problem, a person still has to check what it found, and a person still has to fix it.
That has not changed. For a small business it was always the real work.
If nobody is doing that for your site, that is what Maintain is. If something has already gone wrong, that is Rescue.
If you build software
- Security teams of any size can apply to the expanded Cyber Verification Program to use the models for defence.
- People who look after important open-source projects can sign up for OSS Scanner.
- Open-source maintainers can apply for free Claude Max subscriptions through Claude for Open Source.
- Anyone can use Claude to review code they own, which is the version of this most developers will actually use.
Source: Anthropic's announcement, 8 October 2026. The programme names, partners and limits above come from it. The rest is mine.