Anthropic opens its most powerful models to vetted cybersecurity teams: 129,000 flaws found and a tiered governance trial

By Zendoric · October 7, 2026.

Anthropic has expanded its Cyber Verification Program (CVP), which gives previously vetted cybersecurity teams access to its most powerful Claude models with fewer safeguards than usual. According to the company's own figures reported by Reuters, participants in its Project Glasswing initiative identified at least 129,000 verified vulnerabilities in critical software between April and July of this year. On top of that, another 5,500 were found by Anthropic's own open-source scanning between April and October. More than 33,000 of those vulnerabilities were classified as critical or high severity.

Anthropic admits the figure is probably a floor, not a ceiling: because it comes from a small group of partners, it estimates the real impact could be at least five times greater. It is a number worth reading with both sides in view: on one hand, it measures a mass detection capability that did not exist at this scale before; on the other, it is a reminder that the world's vulnerable software surface remains largely unknown, even to those scanning it with the most advanced AI available.

The new CVP merges two programs Anthropic had been running separately for the past six months: Glasswing, which gave access to Claude Mythos to organizations responsible for protecting critical software, and the original CVP, focused on Claude Opus and Sonnet with reduced safeguards for vetted security teams. The resulting scheme has three tiers. The Defense tier is designed for incident response and malware analysis, and can be applied for by security teams, critical infrastructure operators, open-source project maintainers and researchers with a track record of vulnerability reporting. The Red Team tier enables penetration testing and authorized red team operations, but only for organizations. The Specialized tier, the most restrictive in terms of who gets in but the most permissive in terms of what can be done once inside, is reserved for a small number of entities authorized to test systems critical to people's safety: power grids, flight systems, interbank transfer infrastructure. All tiers give access to Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and whatever models come next; Anthropic says it vets each participant in coordination with the United States government, and partners already in Glasswing will move straight to the Specialized tier.

The move cannot be understood without what preceded it. The launch of Claude Mythos Preview in April set off concerns about whether a model capable of finding and exploiting software vulnerabilities could be used for exactly that before patches arrived. The company's answer has not been to rein in the model's capability, but to wrap it in a tiered access system: the more dangerous what you are allowed to do, the narrower the circle of who can do it and the closer the oversight. It is, in essence, an export control applied to a digital product instead of a physical good, and it connects with what we already saw in how Anthropic treats Mythos as a strategic asset: the model stops being merely a commercial product and becomes a piece over which, in coordination with Washington, it is decided who gets to touch it.

Our reading is that this episode is more interesting as a governance precedent than as a product announcement. Anthropic is not demonstrating a technical breakthrough, but rehearsing live a question every frontier lab will have to answer sooner or later: how do you distribute a dual-use capability that is, at the same time, the best defense available and the best attack tool available? Anthropic's answer —vetting, segmenting by risk level, coordinating with government, documenting findings— is a model of governance based on the use case rather than on blanket prohibition, something we defend as the right approach against the risk of regulating fear instead of actual capability. Another piece of coverage of this same move, published by CDO Magazine, insists on precisely that idea: expanding access demands risk-based governance.

Who wins and who loses under this design also deserves a reading free of naivety. The winners are critical infrastructure operators and open-source project maintainers who, thanks to the Defense tier, gain access to a scanning capability that would otherwise only be within reach of those who can pay for it, which is good news if it genuinely translates into fewer vulnerable systems in production. But the power to decide who enters each tier stays concentrated in Anthropic and the US government, which leaves organizations from other countries out —or in the background— and raises the question of what happens when another lab, with another government behind it, decides to build its own vetting program with different criteria.

In the short term, the honest message is that not even Anthropic knows how many vulnerabilities are really out there, and that opening access to models with fewer safeguards —however vetted the participants— always adds risk surface, from credential leaks to misuse by an actor who manages to slip through the verification process. In the long term, however, finding and closing more than a hundred thousand security holes before someone exploits them is exactly the kind of invisible work on which a safer and cheaper-to-maintain digital infrastructure is built, a necessary —though not sufficient— condition for the abundance we champion as this technology's horizon. The governance experiment Anthropic is running in real time with cybersecurity could well end up being the draft for how, a couple of years from now, even more sensitive capabilities get managed.