The Clinical Frontier · 10 October 2026 · Issue 023 Anthropic launched its Cyber Mission this week. India’s hospital CISOs are the next audience.
In this issue
- Anthropic announced the Cyber Mission on 8 October 2026, comprising the Critical Infrastructure Defence Programme (CIDP) for OT defenders and a free OSS Scanner for open-source projects, with an expected true-positive rate above 90 percent on vulnerability reports.
- The CIDP’s first cohort covers power, water, transportation, and government OT, with expansion to more sectors planned. Hospital OT shares the same threat profile.
- India’s healthcare sector demonstrated its exposure in November 2022, when a ransomware attack on AIIMS Delhi kept services in manual mode for approximately eight days.
- India’s Digital Personal Data Protection Act, 2023, enacted in August 2023 with rules notified in November 2025, creates a regulatory framework that makes proactive cybersecurity a legal obligation, not just an operational preference.
- The OSS Scanner is the most immediately actionable tool for Indian hospital HMIS and FHIR server vendors: enrol open-source components and receive AI-generated vulnerability reports at no cost.
The signal
On 8 October 2026, Anthropic announced the Anthropic Cyber Mission, a long-term programme to shift the advantage toward defenders in software security. The announcement introduced two components.
Critical Infrastructure Defence Programme (CIDP). The programme gives providers that protect operational technology (OT) access to frontier Claude models, on-site Anthropic engineers, and Anthropic’s threat research. OT covers the control systems behind power grids, water systems, transportation networks, and government infrastructure. Founding partners include Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Nozomi Networks, Palo Alto Networks, PwC, and Rockwell Automation. Anthropic states that several partners are already using Claude to find and fix vulnerabilities. The programme begins with a small cohort, with expansion to more partners and sectors planned over the coming months.
OSS Scanner. An opt-in, free service that gives enrolled open-source projects periodic vulnerability scans from Anthropic’s most capable models. Each report includes a proof of concept, an explanation, and a suggested fix where available. Anthropic expects a true-positive rate above 90 percent and notes that some reports may contain errors such as wrong severity ratings. The Defender Advantage Fund (0xDAF), launched in August 2026, keeps the service free.
A separate but related development: Anthropic merged Project Glasswing, which privately reported vulnerabilities in widely used open-source projects to maintainers, into the expanded Cyber Verification Programme. Open-source maintainers can now apply for access to frontier model capabilities to scan their own codebases.
The empirical foundation for the CIDP approach was published in January 2026. In a collaboration with Pacific Northwest National Laboratory (PNNL), Anthropic tested Claude on a high-fidelity simulation of a water treatment plant. Using AI-assisted adversary emulation, attack reconstruction took three hours instead of multiple weeks. The testbed was a Control Environment Laboratory Resource platform operated for the US Department of Homeland Security’s CISA.
India’s hospital cybersecurity context
India’s healthcare sector has experienced its own inflection point. On 23 November 2022, AIIMS Delhi’s eHospital servers went offline following a ransomware attack reported by the National Informatics Centre team. Outpatient, inpatient, billing, appointment, and laboratory services ran in manual mode for approximately eight days. Delhi Police registered a case involving cyberterrorism and extortion. The National Investigation Agency joined the investigation. AIIMS is India’s national apex referral hospital, and the incident reached every level of healthcare administration.
The AIIMS attack is not an isolated data point. India’s healthcare sector’s digital footprint has expanded substantially since 2022: ABDM continues to expand India’s digital health record infrastructure through the Ayushman Bharat Health Accounts programme, the National Health Claims Exchange (NHCX) is live for cashless claims, and hospital HMIS platforms have migrated patient records, lab workflows, and billing to cloud-connected digital systems. Each new integration expands the attack surface that defenders must protect.
On the regulatory side, India’s Digital Personal Data Protection Act, 2023 was enacted and published in the official gazette in August 2023. The Digital Personal Data Protection Rules 2025 were notified by MeitY in November 2025, with core obligations being phased in toward full implementation. Healthcare providers holding patient data are data fiduciaries under the Act. Those designated Significant Data Fiduciaries face additional obligations including data protection impact assessments. When core obligations are fully operative, a breach that exposes patient records will trigger mandatory notification to the Data Protection Board and affected individuals. Poor cybersecurity is becoming a legal risk, not only an operational one.
How the Cyber Mission applies to hospital networks
Hospitals are not named in the CIDP’s first cohort, which focuses on utility and government OT. But the technical threat model is structurally similar, and the tools Anthropic introduced apply directly.
Hospital OT shares the CIDP threat profile. A modern hospital runs OT alongside administrative IT: imaging systems, infusion pumps, ventilators, HVAC, and building management systems all operate on control networks. These systems often run embedded software with long hardware lifecycles and update constraints. They share the same OT characteristics that motivated the CIDP: embedded control software, operational continuity requirements, and high downtime costs. A hospital VLAN that connects a legacy HMIS server to medical device control networks presents exactly the kind of lateral-movement risk the CIDP partners specialise in defending.
Practical actions for Indian hospital IT teams:
-
Apply the CIDP methodology internally. The CIDP approach, using frontier models to accelerate adversary emulation and vulnerability discovery, is replicable without direct programme membership. CIDP founding partners including Accenture, PwC, and Deloitte operate healthcare technology practices in India. Hospital CIOs can engage these partners for structured AI-assisted red-team assessments that apply the same methodology the PNNL test validated: three hours to reconstruct attack chains that previously took weeks.
-
Enrol open-source components in the OSS Scanner. Many Indian HMIS platforms and FHIR server implementations incorporate open-source libraries. Bahmni, an open-source HMIS used at district hospitals in India, and HAPI FHIR, a widely used open-source FHIR implementation, are examples of projects where open-source maintainers can enrol for free, AI-generated vulnerability scans. The expected true-positive rate above 90 percent makes these reports actionable. Hospital vendors and HMIS maintainers with open-source components can enrol now.
-
Apply for the Cyber Verification Programme. Anthropic’s expanded Cyber Verification Programme, which absorbed Project Glasswing, gives qualifying security teams and open-source maintainers access to frontier model capabilities for their own security scanning. Healthcare software maintainers working on open-source clinical tools can apply.
DPDP Act as a cybersecurity forcing function
The phased implementation of the DPDP Act creates a planning window for Indian hospital CISOs to build proactive compliance programmes. When core obligations are fully operative, a ransomware attack that touches patient records will be a notifiable event, not merely an IT incident managed internally.
Running periodic OSS Scanner assessments on hospital software components and documenting those scans creates an audit trail that demonstrates proactive security management. It is the kind of documented process a Data Protection Board inquiry is likely to weigh when assessing whether a breach resulted from negligence or from a genuinely unforeseen threat.
Indian hospitals that are procuring new HMIS, FHIR servers, or lab information systems can also include security assessment requirements in vendor contracts, specifying participation in the OSS Scanner or equivalent AI-assisted vulnerability scanning as a procurement criterion. The tool now exists and is free for open-source projects; the procurement lever follows.
The takeaway
Anthropic’s Cyber Mission on 8 October 2026 is directed primarily at utility and government OT operators. But the two tools it introduced, the CIDP methodology and the free OSS Scanner, are immediately relevant to Indian hospital health-IT teams.
The AIIMS ransomware attack of November 2022 demonstrated the operational cost of inadequate hospital cybersecurity at a national referral centre. India’s DPDP Act 2023, with rules now notified, adds a regulatory dimension to that cost. And the sector’s ongoing shift to ABDM-connected digital records, NHCX-linked claims, and FHIR-based interoperability expands the attack surface faster than most hospital IT teams can defend it unassisted.
The OSS Scanner is a free starting point available today. Enrolment is opt-in. For hospital HMIS vendors and open-source FHIR server maintainers, the cost of not enrolling is the next undetected vulnerability found by an attacker rather than an AI scanner.
The Clinical Frontier is a daily briefing from HCITExperts for India’s health-IT community. Primary sources: Anthropic Cyber Mission, 8 October 2026; Anthropic Critical Infrastructure Defence (PNNL), 8 January 2026. More tomorrow.