Anthropic expands its Cyber Verification Program with three levels of access for security teams

Anthropic has announced an expanded new version of its Cyber Verification Program (CVP), the mechanism through which it offers advanced cyber capabilities and reduced blocking classifiers to security professionals who pass a verification process. The starting point is the dual-use problem: the same capabilities that let a defensive team find and fix a vulnerability can also be used to exploit it for malicious purposes. That is why the generally available models —Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5— ship with conservative safeguards that block most cybersecurity-related work, although the company acknowledges that this also produces false positives that get in the way of legitimate secure coding.

Over the past six months, Anthropic had managed this balance through two separate initiatives: Project Glasswing, which gave access to Claude Mythos to a group of organizations tasked with protecting critical software, and the CVP itself, which offered reduced safeguards on the Opus and Sonnet models to verified security teams. What is new now is the merger of both programs into a single offering structured around three access tiers, each with its own verification requirements and security controls, and all of them with access to the company's most capable models, including Opus 5.5, Sonnet 5.5 and Mythos 5.1.

The first tier, Defense Access, is designed for defensive work: security operations centre work, incident response, malware reverse engineering, and vulnerability analysis or validation. It is open to security teams at companies, NGOs, universities and public bodies defending their own systems, critical infrastructure operators of any size (from regional hospitals to municipal services), small security firms, open-source project maintainers and individual researchers with a track record of reported vulnerabilities. Anthropic expects that a large share of organizations doing defensive cybersecurity will fit into this tier, and commits to responding to applications within a few days.

The second tier, Red Team Access, adds authorized penetration testing and red-teaming exercises, aimed at internal red teams, government teams and firms specializing in pentesting. These organizations may only run adversarial testing against systems for which they have express authorization, including IT infrastructure in critical sectors. Even with this expanded access, real-time blocks remain in place on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems or pentesting high-risk safety systems. Because of the higher bar, Anthropic estimates that reviewing these applications will take several weeks, and in the meantime candidate organizations are provisionally placed in the Defense Access tier. For now, this tier is reserved for organizations, not individual researchers.

The third tier, Specialized Access, is the most permissive in terms of blocks and is reserved for a limited set of verified organizations authorized to test security systems whose failure could directly affect human lives or entire markets: flight operations systems, power grids, telecommunications networks, interbank transfer infrastructure or government administrative networks. Every organization at this tier is reviewed in depth and in collaboration with the US government. Existing Project Glasswing members move automatically to this tier, with no need for new approval for current models.

Beyond these three tiers, the generally available models still allow tasks such as code review, patching known issues, finding vulnerabilities in your own code and triaging security alerts. A cross-cutting requirement of the program is data retention, needed so that Anthropic can monitor potential misuse. That will change once Enterprise Frontier Safeguards (EFS) becomes available later this autumn, a solution that will combine the privacy of zero data retention with robust safeguards, allowing eligible organizations to store data in their own cloud infrastructure. Until EFS is available, organizations with access to Claude Fable 5.1 or Mythos 5.1 under zero data retention will be able to keep using the CVP under that same arrangement.

To validate how effective the different tiers are, Anthropic put Claude Opus 5.5 through CyScenarioBench, an evaluation that measures a model's ability to plan and execute multi-stage cyber operations under realistic conditions, with safeguards set to each CVP tier. Without access to the program, every task was blocked at the very first prompt. At the Defense Access tier, 46 of 50 attempts (five attempts for each of the benchmark's ten challenges) were blocked at some point, while the remaining four succeeded. At the Red Team Access tier there were no blocks at all and Claude Opus 5.5 successfully completed 34 of the 50 tasks, a result practically equivalent to the 67.6% success rate the model achieves with no safeguards applied, a scenario representative of the Specialized Access tier.

As for impact already recorded, Anthropic says that through Project Glasswing its partners identified at least 129,000 verified software vulnerabilities between April and July 2026, on top of another 5,500 verified vulnerabilities found by the company's own open-source scanning efforts between April and October 2026. Of that total, more than 33,000 have been rated critical or high severity. Anthropic itself warns that this figure is probably an underestimate, since it comes from survey data covering only some of the Glasswing partners, and it estimates that the real impact could be at least five times higher. According to some partners, using the Mythos models accelerated their vulnerability detection pace by months or even years compared with how long it would have taken them without the tool; the company explicitly cites accounts from Booz Allen and Comcast on this point. The data itself comes with acknowledged limitations: triage approaches varied across organizations and fewer than half of the partners reported patching figures, often because fixes were still in progress, which Anthropic says significantly underestimates the real rate of patches applied.

On the practical side, the CVP is available on the Claude Platform, on Google Cloud's Vertex AI and on Microsoft Foundry; on Amazon Bedrock it will only be available to customers eligible for Enterprise Frontier Safeguards. Current program members will keep their configuration for previous models and will automatically be assessed for access to Opus 5.5, Sonnet 5.5 and Mythos 5.1 under the updated program. As part of the application process, Anthropic verifies all applicants and asks for evidence of the security controls required for the relevant tier; administrators must also assign access to specific workspaces. The company is also opening a channel for reporting blocks that a team considers unwarranted given its access level.

Taken together, this update fits into a broader Anthropic strategy, also tied to its recent Anthropic Cyber Mission, aimed at giving defenders a sustained advantage over malicious actors without giving up the safeguards that limit unauthorized offensive use of its models. The underlying challenge —how to distribute genuinely dual-use AI capabilities between those who protect systems and those who might attack them— remains one of the most delicate issues in deploying frontier models in information security, and this system of graduated tiers, with different review times and different verification requirements, is the concrete answer Anthropic is proposing for now to that dilemma.