Anthropic on October 6, 2026 rolled out an expanded Cyber Verification Program (CVP), its route for vetted security professionals to use Claude’s advanced cyber capabilities with fewer automatic blocks. The new program folds Project Glasswing and the original CVP into a single offering with three access tiers. Every tier includes Anthropic’s most capable models, namely Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, plus future models as they ship.
For current plans, prices and every Maitz article on Claude, see our Claude hub.
The problem Anthropic is trying to solve is that cyber skills cut both ways: whatever helps a defender find and patch a flaw can also help an attacker exploit it. That is why the generally available models, including Opus 5.5, Fable 5.1 and Sonnet 5.5, ship with conservative cyber safeguards that stop most security work. Until now there were two separate paths around that. Glasswing gave a group of organizations protecting critical software access to Claude Mythos, while the CVP gave vetted security teams reduced safeguards on Opus and Sonnet.
The three tiers of Anthropic’s Cyber Verification Program
- Defense Access: covers defensive work such as SOC and incident response tasks, malware reverse engineering, and analyzing and validating vulnerabilities. It is aimed at security teams at companies, nonprofits, universities and government agencies defending their own systems, critical infrastructure operators of any size (Anthropic cites regional hospitals and municipal utilities), smaller security firms, open-source maintainers, and individual researchers with a record of reported vulnerabilities. Anthropic expects many defenders to qualify and aims to answer applications within a few days.
- Red Team Access: adds authorized penetration testing and red teaming, limited to systems the organization is allowed to test. It is open to organizations only, such as in-house and government red teams and pen testing firms; individual researchers are not eligible for now. Reviews are expected to take a few weeks, and applicants get Defense Access in the meantime. Real-time blocks still apply to actions that could cause physical harm or mass disruption, like deploying ransomware or damaging physical systems.
- Specialized Access: the tier with the fewest cyber blocks, reserved for a small set of verified organizations authorized to test safety-critical systems whose failure could endanger lives or disrupt markets, such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. Each organization is reviewed in depth together with the US government. Current Project Glasswing members move into this tier without reapproval for current models.
Teams outside the program can keep using the standard models for code review, patching known issues, finding vulnerabilities in their own source code and triaging security alerts. Existing CVP members keep their settings for older models and will be evaluated automatically for Opus 5.5, Sonnet 5.5 and Mythos 5.1 access.
Data retention and where it runs
Organizations in the program must allow data retention so Anthropic can watch for cyber misuse. Later this fall, Anthropic plans to launch Enterprise Frontier Safeguards (EFS), which pairs zero data retention privacy with its safeguards and lets eligible organizations keep data in cloud infrastructure they control. Until then, organizations that already have zero data retention access to Fable 5.1 or Mythos 5.1 can use the CVP the same way. For compliance teams in the US and Europe weighing retention rules, that gap until EFS is the practical detail to plan around. The CVP is available on the Claude Platform, Google Cloud’s Vertex AI and Microsoft Foundry, and on Amazon Bedrock only for customers eligible for EFS.
How Anthropic tested the tiers
Anthropic ran Opus 5.5 through CyScenarioBench, an evaluation of whether a model can plan and carry out multi-stage cyber operations under realistic constraints, with safeguards tuned for each tier. Each of the 10 challenges got five attempts per tier. Without CVP access, every task was blocked on the first prompt. In Defense Access, 46 of 50 trials hit a block at some point and four succeeded. In Red Team Access there were no blocks, and the model finished 34 of 50 tasks, effectively matching its 67.6% success rate with no safeguards at all, which Anthropic treats as representative of Specialized Access. The company says the results give it confidence it can safely open these capabilities to more defenders, and that it will keep refining the tier classifiers.
What Glasswing found
According to Anthropic, Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026, and the company’s own open-source scanning turned up another 5,500 between April and October. More than 33,000 of them have been rated critical or high severity so far. Anthropic calls this a likely undercount, since it rests on partial data from 33 partner reports, and expects the real impact to be at least five times higher. Several partners said finding the same number of bugs without Mythos models would have taken them months or even years longer.
Why it matters
Frontier labs are converging on gated access for offensive-grade cyber capabilities. Google took a similar route when it launched Gemini 4 Argon for cyber defenders first. Anthropic’s tiers turn that idea into clearer rules: defensive work and vulnerability research go through Defense Access, pen testing requires an organization rather than a solo researcher, and the most sensitive tier is vetted with the US government. If you already build on Claude, our coverage of Claude Sonnet 5.5 covers one of the models included in every tier. More updates in our AI News section.
Sources
- Anthropic, official blog: Expanding the Cyber Verification Program, October 6, 2026, anthropic.com
