Anthropic has stood up what it's calling the Cyber Mission, and the part that matters if you maintain open-source code is OSS Scanner: a free, opt-in service that runs Claude over your project and files vulnerability reports. The reports are fully model-generated and sent without a human in the loop, and the company claims a true-positive rate above 90%. Before launch, pen testers checked 97 critical and high-severity findings across 48 projects and judged 85 of them worth disclosing. wolfSSL says that of the 74 reports it received, all but two were valid and five became CVEs. Eligible core maintainers enroll by opening a pull request against Anthropic's oss-scanner repo; projects that can't triage a flood of findings keep getting human-verified disclosures instead. The other half is the Critical Infrastructure Defense Program, which hands frontier models, on-site engineers, and threat research to a small founding cohort — Palo Alto Networks, CrowdStrike, Dragos, Rockwell Automation, and seven others — defending power, water, and transport systems. Anthropic is backing the whole effort with up to $100M in Claude Mythos Preview credits and $4M in donations to open-source security groups. The honest read: the infrastructure side is partner-gated and thin on timelines, but the OSS scanner is something any qualifying maintainer can opt into today.