> ## Content Index > Fetch the complete content index at: https://theainewsfiles.com/llms.txt > Use this file to discover other available public pages before exploring further. # Anthropic Opens Its Most Cyber-Capable Models to Security Teams in a Three-Tier Program - URL: https://theainewsfiles.com/anthropic-cyber-verification-program-three-tiers/ - Published: 2026-10-07T12:26:07.000Z - Updated: 2026-10-16T09:55:57.000Z - Description: Anthropic's expanded Cyber Verification Program gives vetted security professionals access to Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1 with reduced safeguards — in three tiers, with the top tier reviewed alongside the US government. - Author: J E Cowie - Tags: News *Above: Anthropic's logo. (Image: Anthropic logo, CC0, via Wikimedia Commons)* On Tuesday, Anthropic announced an expanded version of its Cyber Verification Program — a three-tier access scheme that gives qualifying security professionals use of its most cyber-capable models with reduced blocking classifiers. The program merges two initiatives that have run in parallel for the past six months: Project Glasswing, which gave a group of organisations securing the most critical software access to Claude Mythos, and the original CVP, which offered [vetted security teams](https://theainewsfiles.com/gemini-4-argon-fairwind-bloomberg-skepticism/) reduced safeguards on Claude Opus and Claude Sonnet. The move is significant for a straightforward reason: Anthropic's generally available models currently block most cyber work. Claude Opus 5.5, Claude Sonnet 5.5, and Claude Fable 5.1 all carry what Anthropic describes as "conservative cyber safeguards that block most cyber work." The CVP is the mechanism by which those blocks are selectively lifted — for people Anthropic has verified are doing defensive work. ## Three tiers, three levels of access Each tier includes access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and new models as they ship. The differences are in scope and verification. **Defense Access** is the tier Anthropic expects many defensive organisations to qualify for. It covers security operations centre work, incident response, malware reverse-engineering, and vulnerability analysis. Qualifying applicants include security teams at companies, nonprofits, universities, and government bodies; operators of critical infrastructure (regional hospitals, municipal utilities); smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. Anthropic says it aims to respond to applications within a few days. **Red Team Access** adds authorised penetration testing and red-teaming to the defensive uses above. It is restricted to organisations — individual researchers are not eligible. Even in this tier, real-time blocks remain on actions that could cause physical harm or mass disruption: deploying ransomware, damaging physical systems, or pen-testing high-risk safety systems. Anthropic expects applications here to take a few weeks to review. **Specialized Access** has the fewest cyber blocks and is reserved for a limited set of verified organisations authorised to test safety-critical systems: flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. Anthropic states: "For this tier, we currently review every organization in depth in collaboration with the US government." Existing Project Glasswing members transition into this tier and do not require reapproval for current models. ## The numbers Anthropic is reporting The announcement carries a set of vulnerability figures that are worth reading carefully, because they are Anthropic's own self-reported counts. Anthropic says that through Project Glasswing, its partners "uncovered at least 129,000 verified software vulnerabilities between April and July 2026." Through its own open-source scanning efforts, it found an additional 5,500 verified vulnerabilities between April and October 2026\. Of the combined total, more than 33,000 have so far been rated critical- or high-severity. Anthropic says the figures are likely an undercount because they are based on survey data from only a subset of Glasswing partners, and on that basis it expects the true impact to be at least five times higher. It calls the results a lower bound, based on partial data from 33 partner reports plus its own open-source partnerships, and lists further limitations: partners took different approaches to triaging, and fewer than 50% of partners disclosed how many vulnerabilities they had patched, often because fixes were still in progress, so Anthropic says the patch rate is significantly undercounted. Reuters, which reported the announcement on Tuesday, repeats Anthropic's figures and its undercount caveat. ## The dual-use problem, stated plainly Anthropic's own framing of the tension is direct: "Cybersecurity is inherently dual use: the same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it." Anthropic presents that tension as the reason for its safeguards, alongside its argument that defenders also need access to the most powerful capabilities. The models are capable enough to find vulnerabilities at scale; the safeguards exist to stop that same capability from being turned against systems. The CVP is the compromise — lift the blocks for people who have been verified as defenders, keep them for everyone else. The US government's role in vetting the top tier is notable. Anthropic says it currently reviews every Specialized Access organisation in depth in collaboration with the US government; Reuters reports it as Anthropic vetting "each member together with the US government." ## What the benchmarks show To test whether its tier-based classifiers actually work as intended, Anthropic ran Claude Opus 5.5 through CyScenarioBench, an evaluation of multi-stage cyber operations under realistic constraints, with safeguards tuned for each tier. Across five attempts at each of 10 challenges: - Without CVP access, every task was blocked on the first prompt. - In the Defense Access tier, 46 of 50 trials were blocked at some point; four succeeded. - In the Red Team Access tier, no blocks occurred, and Claude Opus 5.5 completed 34 of 50 tasks — which Anthropic says is effectively equivalent to the model's 67.6% success rate with no safeguards applied. These are Anthropic's own evaluation results, run with its own model. They are internally consistent with the tier design, but they are not an independent test. ## What is still to come Two things in the announcement are forward-looking rather than live. First, Enterprise Frontier Safeguards (EFS) — a solution combining zero data retention with robust safeguards — is described as "available later this fall." Data retention is required for enrolled organisations so Anthropic can monitor for cyber misuse; once EFS is available, eligible organisations will be able to store that data in cloud infrastructure they control. Until it ships, organisations that already have Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can also use CVP with zero data retention. Second, Anthropic says it will "share more" in the coming weeks about its work to secure open-source software and critical infrastructure. The specific commitments behind that are not yet detailed. ## What this adds up to The models the expanded CVP unlocks — Opus 5.5, Sonnet 5.5, Mythos 5.1 — already exist; existing CVP members will be automatically evaluated for access to them through the updated program. What is new is the structure: a single, tiered, application-based pathway that replaces two parallel tracks, with a clearer escalation from broad defensive access to the most sensitive safety-critical testing. The vulnerability numbers, for what they are worth, suggest the underlying capability is doing something at scale. In its June post expanding Project Glasswing, Anthropic argued that "the bottleneck in cybersecurity is now verifying, disclosing, and patching the large numbers of vulnerabilities that Mythos-class models can surface." The open question is whether the verification and tiering system is robust enough to keep that capability on the defensive side of the ledger. --- **Sources** Anthropic (2026) 'Expanding the Cyber Verification Program', Anthropic, 6 October 2026, available at: [https://www.anthropic.com/news/cyber-verification-program](https://www.anthropic.com/news/cyber-verification-program?ref=theainewsfiles.com) (Accessed: 7 October 2026). Anthropic (2026) 'Expanding Project Glasswing', Anthropic, 2 June 2026, available at: [https://www.anthropic.com/news/expanding-project-glasswing](https://www.anthropic.com/news/expanding-project-glasswing?ref=theainewsfiles.com) (Accessed: 7 October 2026). Reuters (2026) 'Anthropic opens its most powerful AI models to more security teams', Reuters, 6 October 2026, available at: [https://www.reuters.com/legal/litigation/anthropic-opens-its-most-powerful-ai-models-more-security-teams-2026-10-06/](https://www.reuters.com/legal/litigation/anthropic-opens-its-most-powerful-ai-models-more-security-teams-2026-10-06/?ref=theainewsfiles.com) (Accessed: 7 October 2026).