Finding a security hole is getting easier with AI. Fixing it is not. That gap is the most useful lesson in Anthropic's new Cyber Mission, and it matters to anyone who relies on AI for security.
This article explains what the Cyber Mission is, what launched first, where Anthropic says the limits are, and what to ask your own security vendor.
What is the Anthropic Cyber Mission?
Anthropic announced its Cyber Mission on October 8. It starts with two areas: critical infrastructure, such as power grids, water systems and transport networks, and open-source software.
The two areas are very different, but the lesson in the announcement applies to both.
What launched first
Two things came with the announcement.
- A defense program for critical infrastructure. It has 11 founding partners, including Accenture, CrowdStrike and Deloitte.
- A free, opt-in scanner for open-source projects. Projects choose to take part.
The program starts with a group of 11 partners. The scanner is free and optional, so projects opt in rather than being scanned by default.
Why finding AI security vulnerabilities is easier than fixing them
The most useful part of the announcement is what Anthropic says about its own limits. Finding a flaw is only the first step. After that, someone has to verify it, decide how urgent it is, and fix it. Anthropic says those steps still take time.
Three limits stand out:
- Fixing is slow. In its open-source work, months often passed between discovery and repair. A faster way to find flaws does not automatically make the later steps faster.
- Some fixes have to wait. In power and water systems, certain fixes must wait until the systems can be patched safely. A known flaw can therefore sit unfixed for a while.
- Reports can be wrong. Scanner reports go out without human review, so some may be inaccurate. That makes reports faster, and it also means a person on the receiving end has to check them.
Taken together, these limits describe a bottleneck. AI makes the first step easier, and the work that follows still depends on people, time and careful decisions.
What this means for professionals who rely on AI security tools
If your organization uses AI for security, the Cyber Mission offers a practical way to think about it. A tool that finds more problems is only useful if your team can handle what it finds.
Consider what happens after a tool reports a flaw:
- Someone needs to check whether the report is accurate.
- Someone needs to decide which findings matter most.
- Someone needs to fix the problem, sometimes at a time when it is safe to do so.
If none of these steps has an owner, a longer list of findings can add to the workload without making you safer. The value of an AI security tool depends on the process around it as much as on the tool itself.
Questions to ask your security vendor
When you evaluate an AI security tool or service, ask about the whole path from finding to fixing, not only the finding.
- Who checks the findings? Ask whether a person reviews reports before they reach you, and what happens when a report turns out to be wrong.
- Who does the fixing? Ask what the vendor does after it finds a flaw, and what is left for your own team.
- What happens when a fix cannot happen right away? Some systems cannot be changed immediately. Ask how risk is managed in the meantime.
Clear answers to these questions tell you more about a vendor than the number of flaws it can find.
Key takeaway
Finding problems faster only helps if you can fix them faster too. Before you add AI to your security work, decide who verifies the findings, who prioritizes them, and who owns the fix. The Cyber Mission is a reminder that finding the problem is only part of the work.