Anthropic infrastructure security, the Gemini work agent, and influence operations
Issue date:
This issue covers Anthropic’s programs for critical infrastructure and open-source code, Google Cloud’s work-agent announcement, and OpenAI’s report on two disrupted influence operations. Their status differs: enrolled projects can use the scanner, the agent’s availability is unspecified, and OpenAI describes threats rather than releasing a defensive product.
This issue may include important events published earlier.
Anthropic introduces Cyber Mission for industrial systems and open-source code
Anthropic announced Cyber Mission as a long-term cybersecurity initiative. Its first two areas are the Critical Infrastructure Defense Program (CIDP) and OSS Scanner. CIDP brings together Claude models, on-site engineers, and threat research for providers trusted by operators to protect industrial equipment and networks. OSS Scanner offers enrolled open-source projects free periodic scans. Its reports describe how a suspected bug could be exploited and suggest a fix where one is available.
Key facts
CIDP focuses on providers securing operational technology: the equipment, control software, and networks used in power, water, manufacturing, and transport.
Anthropic names Accenture, CrowdStrike, Deloitte, Dragos, Palo Alto Networks, and Rockwell Automation among CIDP’s partners. It says some partners are already working with Claude on vulnerabilities, while the first phase involves a small cohort of providers.
OSS Scanner is an opt-in, free service. Anthropic sends enrolled projects model-generated reports without its own human review.
Anthropic expects more than 90% of scanner findings to be true positives. This is a forecast, not a published measured result; the company warns that reports may misstate a vulnerability’s severity.
An objective look at what matters
Regular scans may give small maintenance teams more findings to investigate. Receiving a report, however, does not establish that a bug is real or a proposed fix is safe. The distinction matters especially in industrial systems: equipment often cannot be stopped for an update, and a faulty change can disrupt operations. Practical value depends on checking findings and applying fixes without compromising reliability.
Business processes
Critical-infrastructure vulnerability management — A security provider may use Claude to investigate weaknesses with an operator; specialists still decide whether and how to change a running system.
Open-source maintenance — An enrolled team can receive periodic findings and move to investigation sooner, provided it has the capacity to review them.
Automation opportunities
Periodic scanning of an open-source project: A model prepares an initial finding, an example of possible exploitation, and a proposed fix when available. Maintainers verify the bug, its priority, and the patch before release. Conditions: The project must enroll in OSS Scanner; the service is intended for teams able to handle incoming findings.; Anthropic sends reports without human review, and they may contain errors.
Assistance to operational-technology security providers: Models may help identify weaknesses and prepare remedies. Anthropic describes work with some partners but gives no measured outcomes for operators. Conditions: CIDP begins with a small cohort of providers.; Changes to industrial equipment require separate reliability checks and a safe time to apply them.
Impact on manual work
Periodic scanning automates the search for potential bugs, but people still review reports and decide on fixes. Anthropic describes faster triage and patching as future work and provides no measurement of manual effort saved.
Limitations and risks
An expected true-positive rate above 90% does not guarantee that any particular report or proposed fix is correct.
A stream of unreviewed findings may overwhelm open-source maintainers.
Even a confirmed patch for a running industrial system may not be quick or safe to install.
Google Cloud announces Gemini agent for work across business systems
At Gemini at Work 2026, Google Cloud introduced Gemini agent as a single interface for work requests. According to the company, it plans tasks, uses tools, and connects to Google Cloud customers’ business systems. It is meant to return results in familiar environments, including documents, inboxes, and developer tools. Google Cloud also claims model selection for each task, cost controls, and enterprise security and governance features. The announcement does not say who can access the agent or when.
Key facts
Google Cloud announced Gemini agent at Gemini at Work 2026.
Google Cloud says the agent uses organizational context, tools, and connected business systems to carry out requests from a single prompt interface.
Google Cloud claims that the agent selects a model for the task and includes cost controls, security, administration, and enterprise governance features; it provides no measurements of their performance.
An objective look at what matters
If the promised connections and permissions are in place, a single request could potentially combine information retrieval, drafting, and actions across applications. A unified interface does not settle which data the agent may read or what it may do. The brief announcement cannot establish the scope of integrations, the quality of results, or the effort required to deploy it. Organizations would need to set access boundaries and review consequential outcomes separately.
Business processes
Document and knowledge work — Google Cloud says the agent can use organizational context to answer questions and prepare material; answers would still need checking.
Tasks spanning applications — Connected systems could reduce manual switching where the necessary integrations and permissions are actually available.
Software development — The company names developer environments as places where the agent can return results, but does not describe validated coding workflows.
Automation opportunities
Handling a multi-step request across documents, inboxes, and connected systems: The announced agent may plan steps, call tools, and return a result in a work application. This describes a proposed workflow, not established effectiveness in customer deployments. Conditions: The announcement does not specify availability, access terms, or a list of supported systems.; Organizations would need to limit the agent’s access and actions and arrange human review for consequential operations.
Impact on manual work
Planning and tool use could reduce manual movement between systems. The publication gives no deployment results, time-savings figures, or rate of tasks completed without correction.
Limitations and risks
Availability, pricing, supported integrations, and technical limits are not disclosed.
The capabilities are vendor claims; the announcement contains no independent measurements.
Access to enterprise context and authority to act in business systems need separate controls. Claimed governance features do not, by themselves, establish that a particular workflow is safe.
OpenAI describes disrupting influence operations originating in Russia and Iran
OpenAI said it banned two influence operations that used its models alongside conventional ways of producing and distributing material. The Russia-origin operation, Dark Clark, involved a false-front research center in Latin America. The Iran-origin operation, Bogus Bylines, used seven fabricated author personas to pitch articles to online outlets and also prepared social-media comments. This is a report on misuse of models, not an announcement of a tool that automatically detects such operations.
Key facts
OpenAI says it banned account clusters associated with operations originating in Russia and Iran and shared information on both cases with relevant authorities.
According to OpenAI, the Russian operators used ChatGPT most often for internal reports. They also used it for some texts, translations, and stylistic adaptation of fabricated material.
OpenAI rated the Russia-origin operation Category 5 on the six-point Breakout Scale for potential reach, and the Iran-origin false-byline article campaign Category 4. These are not counts of people whose views changed.
OpenAI found almost 100 articles published or syndicated under names linked to the Iranian operation across roughly a dozen online outlets. It assessed the social-media comments it found as attracting little engagement.
An objective look at what matters
The risk here was not merely the use of AI to produce text. False author identities and organizations made material appear independent, while established outlets could distribute it. For teams handling articles, emails, or purportedly official documents, checking a sender’s identity and a submission’s provenance is more useful than guessing whether a model wrote the text. A published article, however, is not proof that it influenced its audience.
Business processes
Editorial review of submissions — Before publication, a team can check an author’s identity, profile history, and the origin of submitted material.
Corporate communications — Messages, documents, and pitches from unfamiliar organizations can be checked against independent contacts, particularly when they claim official authority.
Threat monitoring — Links among profiles, false-front organizations, and repeated pitches may justify investigation, but are not evidence on their own.
Automation opportunities
Initial screening of author pitches and incoming material: As a possible defensive approach, tools could flag inconsistent profiles and repeated submission patterns for an employee to investigate. OpenAI does not report releasing or testing such a tool. Conditions: An automated signal proves neither that a text is false nor who wrote it.; Publication or blocking decisions require human review and additional evidence.
Impact on manual work
The report documents operators’ methods but does not evaluate an automated defensive review process for incoming material. It gives no figures for editorial or analyst work saved.
Limitations and risks
OpenAI could not corroborate all claims in the operators’ internal reports; some claimed credit for others’ work.
A Breakout Scale rating of potential reach is not proof of audience impact. The Iranian operation’s observed comments received little engagement.
AI assistance in producing a text does not, by itself, make it false or part of an influence operation.
False personas and VPN use complicate provenance checks; a single warning sign should not become an accusation.
