Anthropic expands its Cyber Verification Program
On 6 October 2026 Anthropic announced a new, expanded Cyber Verification Program that merges Project Glasswing with the earlier programme and gives verified security teams three tiers of access to its most capable models (Claude Opus 5.5, Sonnet 5.5, Mythos 5.1) with fewer cyber blocks. The company reports that Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026.
Why it matters
The company turns trusted access for a handful of organisations into a tiered scheme open to many more defenders, down to regional hospitals and municipal utilities. Its own test shows the tiers work as designed: on one cyber benchmark everything is blocked without access, 46 of 50 trials in the first tier and none in the second. The vulnerability counts are Anthropic's and, by its admission, partial.
What the announcement says. The new version of the CVP has three access tiers, each covering Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and "new models moving forward". Defense Access is for defensive work (security operations centres, incident response, reverse-engineering malware, analysing and validating vulnerabilities): Anthropic expects many organisations to qualify, including operators of critical infrastructure of any size and individual researchers with a record of reported vulnerabilities; it aims to answer applications "within a few days". Red Team Access adds authorised penetration testing and red-teaming, for organisations only, with a review of a few weeks; real-time blocks remain on actions that could cause physical harm or mass disruption, such as deploying ransomware. Specialized Access has the fewest blocks and is reserved for a limited set of verified organisations authorised to test systems that could affect people's lives or disrupt markets (flight operating systems, power grids, telecom networks, interbank transfer infrastructure, government administrative networks); Anthropic reviews each organisation in depth in collaboration with the US government, and Project Glasswing members move to this tier without reapproval. Data retention is required; Enterprise Frontier Safeguards, which combines the privacy of zero data retention with safeguards, is promised "later this fall". Glasswing and the CVP ran separately for six months: the first gave a group of organisations access to Claude Mythos, the second gave vetted security teams reduced safeguards on Opus and Sonnet models. Testing the tiers. Anthropic ran Claude Opus 5.5 through CyScenarioBench (multi-stage cyber operations under realistic constraints) with the safeguards of each tier: without CVP access every task was blocked on the first prompt; in Defense Access 46 of the 50 trials (five attempts at each of 10 challenges) were blocked at some point and four succeeded; in Red Team Access no blocks occurred and 34 of 50 were completed, the same as with no safeguards (67.6%). Glasswing results. The company says partners found at least 129,000 verified software vulnerabilities between April and July 2026 and its own open-source scanning found a further 5,500 between April and October; more than 33,000 were rated critical or high. The data come from 33 partner reports and are a lower bound; Anthropic expects the true impact to be "at least five times higher". Fewer than 50% of partners disclosed patched numbers, so the patch rate is heavily undercounted. Availability: the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry; on Amazon Bedrock only for customers eligible for Enterprise Frontier Safeguards. What the record does not claim. All the numbers are Anthropic's own measurements and have not been confirmed independently. The terms of each tier, which the page refers to its help centre, were not read.