Anthropic opens up access to its cybersecurity AI and cuts Haiku's price under pressure from Chinese open models

By Zendoric · October 8, 2026.

Anthropic moved two pieces on two consecutive days in apparently opposite directions, but with the same underlying logic. On October 6 it expanded its Cyber Verification Program (CVP), launched in April alongside the then heavily restricted Claude Mythos, under what is known as Project Glasswing. The expanded version reduces blocking classifiers and creates three access tiers for security professionals who can demonstrate sufficient controls: depending on the tier, they grant access to Mythos 5.1 (the cybersecurity model Anthropic had kept under lock and key), Opus 5.5 (the most powerful and expensive in the catalog) and Sonnet 5.5 (fast and cheaper). A day later it launched Claude Haiku 5.5, designed for tasks that reward speed — browser use, customer support — and, according to other coverage of the same announcement, halved the cache-read price of Sonnet 5.5.

The context explains the hurry. Carter Huffman, chief executive of voice AI firm Modulate, sums up the pressure in one sentence: "having 10,000 people using the second-best model is far more effective than having 100 using the best." He is referring to the fact that Chinese vendors such as Z.ai already distribute models openly — GLM-5.2 and GLM-5.3 — that, in his view, perform similarly in cybersecurity and threat detection, without the access barriers Anthropic imposed on Mythos for fear it would fall into attackers' hands. If the "almost as good" model is already circulating free and unchecked, keeping the best one locked up protects little and costs competitiveness.

That supposed parity deserves qualification, because the ground is slippery: the source offers no comparative figures that would allow the real distance between Mythos and the open Chinese models to be measured. Dennis Xu, an analyst at Gartner, points in that direction: open models offer effective defensive capability, but they still lag behind those of Anthropic and OpenAI, and accessing the latter "isn't cheap: you pay extra for better defense and better offensive testing." The CVP itself is free to apply to, but whoever gets in pays for token consumption at standard prices.

Anthropic is not the only one playing this card of supervised access rather than total secrecy: OpenAI has its Daybreak program and Google its own, Fairwind, both designed to put frontier models in the hands of trusted defenders without releasing them to the public. CrowdStrike and Nvidia have taken another route with SafeMind, an agentic cybersecurity suite built on the Nemotron models. Trust, however, runs both ways: Anthropic requires applicant companies to demonstrate sufficient controls to avoid leaking the model to third parties, and companies have to trust that Anthropic's filter holds. As Chirag Shah, a professor at the University of Washington, notes, attackers "are getting more and more sophisticated," so defenders need equally sophisticated tools: an argument for widening access, not restricting it.

The other leg of the announcement, the cheaper Haiku 5.5, belongs to the same price war OpenAI and Anthropic have been waging for months. According to figures compiled by TechTarget, Haiku costs $0.10 per million input tokens up to 100,000 tokens of context and $0.50 per million beyond that, with output at $0.50 and $2.50 per million respectively. OpenAI's GPT-6 Luna stays at $0.10 and $0.50 per million with no tiering: in short contexts the two tie, in long ones Haiku comes out more expensive. That Anthropic is competing to the cent in its cheapest tier while opening its most restricted model to vetted users is no coincidence: on both fronts it is competing against a Chinese offering that is already "good enough" and far cheaper, or outright free.

Our reading is that both moves are the same strategic response seen from two angles. In the short term, the message is honest and uncomfortable: neither Anthropic nor anyone else now controls on its own who gets access to an AI capable of finding vulnerabilities or launching attacks; all that remains to be decided is whether that capability spreads in a governed way — with verification, traceability and consequences for whoever leaks it — or whether the ground is ceded to whoever gives it away with no strings attached. In the long term, if the cost of automated defense keeps falling at the pace these price cuts suggest and access governance matures as fast as capability, the plausible outcome is that more organizations — not just those able to pay for expensive consultancies — end up shielded with the same tools that today are mostly deployed by the best-funded attackers. That is, on a small scale, the promise of abundance we defend for AI in general: it does not eliminate the risk of the technology being misused, but it does reduce the structural advantage of those who attack over those who merely defend.