Anthropic has expanded its Cyber Verification Program (CVP) to allow cybersecurity experts to use Claude’s high-performance cybersecurity capabilities with fewer restrictions. While the version of Claude available to general users includes safeguards that block cyber operations with a high risk of abuse, the program grants verified defense organizations broader access based on their business needs and risk levels.
This reorganization combines the experiences of the existing CVP and Project Glasswing and will operate under a three-tiered approach. At every stage, users can utilize Claude Opus 5.5, Sonnet 5.5, Mythos 5.1, and future models; the highest tier, “Specialized,” even supports approved security testing for safety-critical systems such as power grids, aviation systems, and interbank payment infrastructure.
| The dilemma with cybersecurity AI is that “defense and attack are based on the same technology.”
While the ability to identify vulnerabilities and analyze attack vectors is useful for security teams, it can be just as useful for attackers. That’s why Anthropic’s general services have applied conservative blocking policies to tasks such as malware analysis, penetration testing, and vulnerability exploitation. The problem is that this leads to false positives that block even legitimate security research.
CVP is an attempt to solve this problem through user verification and tiered permissions. Instead of lowering restrictions for all users, we provide more powerful features only to organizations whose identities have been verified and whose legitimate security purposes have been confirmed. This means that as AI models become more capable, the key safety design consideration is “how to grant access without weakening the model itself.”
| The new CVP is divided into three tiers: Defense, Red Team, and Specialized
Defense Access is designed for relatively common security tasks, such as incident response, malware analysis, and vulnerability research for defensive purposes. Security teams, critical infrastructure operators, open-source maintainers, and researchers with a track record of reporting vulnerabilities are eligible to apply. This tier minimizes blocking compared to standard services but restricts the scope of aggressive usage.
Red Team Access even allows for organization-approved penetration tests and red team activities. Applications must be submitted by organizations, not individual researchers, and require more rigorous verification. Specialized Access is the least restrictive tier and is designed for use by a small number of verified organizations when testing safety-critical infrastructure such as power grids, aviation, and interbank systems.
| All models, including the Opus 5.5, Sonnet 5.5, and Mythos 5.1,
A key change in this program is that, rather than offering just a single specific model, it bundles Anthropic’s family of high-performance models under a tiered policy. According to the official announcement, all three tiers include Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. The level of model safety safeguards varies depending on the user’s eligibility and business purpose.
In particular, the Mythos series has been promoted as a line of models that excels at cybersecurity tasks. Organizations that were previously part of Project Glasswing will transition to “Specialized Access” under the new system. By consolidating the programs into a single authorization system rather than keeping them separate, the structure has become clearer: enterprise customers can apply for the level of access they need, and Anthropic reviews each request based on risk.
| Glasswing partners identified at least 129,000 vulnerabilities
Anthropic announced that organizations participating in Project Glasswing identified at least 129,000 verified software vulnerabilities between April and July 2026. In a separate open-source scan conducted by the company, approximately 5,500 additional verified vulnerabilities were discovered between April and October. Of these, more than 33,000 have been rated as “high” or “critical” in severity to date.
However, we shouldn't oversimplify this figure by assuming that Claude alone automatically discovered 130,000 new vulnerabilities. The figure of 129,000 cases represents the combined activities of various partner organizations, and Anthropic explained that the actual impact could be even greater since its figures are based on surveys of select partners. The specific methods used to determine which cases were identified directly by AI and which were verified by humans may vary by organization.
| "Vulnerability chaining"—which existing scanners miss—is a key use case.
In a case study published by Anthropic, security teams used Claude to identify “exploit chains”—combinations of multiple small vulnerabilities that create actual attack paths—rather than focusing on a single vulnerability. While existing automated scanners are strong at detecting individual vulnerabilities, they may have limitations when it comes to inferring attack possibilities by synthesizing information across different systems and permission relationships.
Large language models can read code, configurations, documentation, and execution results together to suggest the next steps in an investigation, making them well-suited for this type of comprehensive analysis. On the other hand, since the model might generate incorrect attack vectors or suggest commands that pose a risk to actual production environments, expert verification and isolated testing environments remain essential.
| We also found that the actual completion rate changes significantly when the limit is lowered.
Anthropic also released the results of its internal evaluation, CyScenarioBench. With Claude Opus 5.5 set to “Defense Access,” 46 out of 50 tasks were blocked by safety mechanisms, but in “Red Team Access” mode, no tasks were blocked, and 34 out of 50 were completed. The company explained that this completion rate was the same as that of a configuration without safety mechanisms.
These results demonstrate that access policies can have as significant an impact on actual performance as the model itself. At the same time, relaxing access restrictions could increase the potential for abuse. That’s why Anthropic has stated that it verifies applicant organizations and, for the “Specialized” tier, screens participants in collaboration with the U.S. government. Going forward, it will be crucial to ensure that these verification procedures are administered strictly and consistently.
| Expanding access to critical infrastructure increases both benefits and risks
In systems where the cost of downtime is high—such as power grids, aviation systems, and interbank payment networks—AI can be highly effective in defense if it quickly identifies vulnerabilities. This is because AI can assist in areas that are difficult for humans to fully inspect due to legacy code and complex supply chains. Automated testing can be particularly useful when vulnerabilities in open-source components spread across multiple industries.
On the other hand, the same functionality can also be used by attackers to explore attack vectors and exploit vulnerabilities on a large scale. Even if the program is made available only to “verified experts,” issues such as account hijacking, misuse by insiders, and testing beyond authorized scope will remain. Operational controls—such as audit logs, revocation of permissions, and management of approval scopes—will determine actual security more than the expansion of access itself.
| From now on, competition will range from “model safety” to “user-centric design”
Anthropic's new CVP creates a tiered access model that strikes a balance between the two extremes of unconditionally restricting high-performance AI or making it completely open. While the discovery of more than 129,000 verified vulnerabilities is cited as evidence that providing powerful models to defenders is worthwhile, it also demonstrates that the risk of those capabilities being misused for attacks has increased.
Areas to be verified in the future include the actual number of participating organizations, the evaluation criteria, the time taken from vulnerability discovery to patching, the false positive rate, and whether any instances of exploitation have occurred. In the field of cybersecurity, determining who can use a model and under what permissions is becoming just as important as the model's peak performance. If Anthropic's approach proves successful, other AI companies are likely to expand similar verification-based high-privilege programs.
Tags
#Anthropic #Claude #ClaudeOpus55 #ClaudeSonnet55 #ClaudeMythos51 #CyberVerificationProgram #ProjectGlasswing #Cybersecurity #AI Security #Vulnerability #Red Team #Critical Infrastructure
