Broadening the Cyber Authentication Initiative

Anthropic announced an expanded Cyber Verification Program (CVP) on October 6, 2026, restructuring its trusted-access initiative into three distinct tiers that give qualifying security professionals access to advanced cyber capabilities with reduced blocking classifiers. The move consolidates two previously separate programs—Project Glasswing and the original CVP—into a single offering aimed at extending defender access to Anthropic's most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models.

Background: Why Safeguards and Access Pull in Opposite Directions

Cybersecurity capabilities are inherently dual use. The same model behaviors that help a security team find and fix a vulnerability can also help a malicious actor exploit it. For this reason, Anthropic's generally available models—Claude Opus 5.5, Claude Fable 5.1, and Claude Sonnet 5.5—carry conservative cyber safeguards that block most cyber work. The company says this limits harmful activity while it continues reducing false positives for secure coding.

Over the past six months, Anthropic ran two access programs to balance that tension. Project Glasswing gave organizations securing critical software access to Claude Mythos. The original CVP gave vetted security teams access to reduced safeguards on Claude Opus and Claude Sonnet models. The expanded program merges both into one framework.

The Three Tiers and What Each Unlocks

Defense Access covers defensive work: security operations center tasks, incident response, reverse-engineering malware, and analyzing and validating vulnerabilities. Qualifying organizations include security teams at companies, nonprofits, universities, and government bodies defending systems they own; critical infrastructure operators of any size, such as regional hospitals or municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. Anthropic expects many defensive organizations to qualify and aims to respond to applications within a few days.

Red Team Access adds authorized penetration testing and red-teaming to the defensive uses above. Qualifying organizations include in-house red teams, government red teams, and security and penetration testing firms. Adversarial testing is limited to systems the organization is authorized to test, including IT systems in critical industries. Real-time blocks remain on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or pen testing high-risk safety systems. Review takes a few weeks; qualifying organizations are enrolled in Defense Access while their Red Team Access application is processed. This tier is organizations-only—individual researchers are not eligible.

Specialized Access, with the fewest cyber blocks, is reserved for a limited set of verified organizations authorized to test safety systems that could impact lives or disrupt markets, including flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. Anthropic reviews every organization in this tier in depth in collaboration with the US government. Existing Project Glasswing members transition to this tier and do not require reapproval for current models.

Generally available models remain usable for code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts.

Benchmarking the Tiers: CyScenarioBench Results

To assess CVP protections, Anthropic ran Claude Opus 5.5 through CyScenarioBench, an evaluation measuring whether models can plan and execute multi-stage cyber operations under realistic constraints, with safeguards tuned for each tier. Across five attempts at each of the 10 challenges per tier:

• Without CVP access, every task was blocked on the first prompt.
• In Defense Access, 46 of 50 trials were blocked at some point; four tasks succeeded.
• In Red Team Access, no blocks occurred and Claude Opus 5.5 completed 34 of 50 tasks—effectively equivalent to the model's 67.6% success rate with no safeguards applied, representative of Specialized Access.

What Project Glasswing Already Delivered

Through Project Glasswing, Anthropic says Claude Mythos models significantly increased the rate at which organizations identified vulnerabilities in their systems. Partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026, and Anthropic's own open-source scanning found an additional 5,500 verified vulnerabilities between April and October 2026. More than 33,000 of these have so far been rated critical- or high-severity. Anthropic cautions this is likely an undercount based on survey data from only a subset of Glasswing partners, and expects the true impact to be at least five times higher. The figures represent a lower bound: they draw on partial data from 33 partner reports and Anthropic's open-source partnerships, fewer than 50% of partners disclosed patched numbers, and triaging approaches varied.

Data Retention, Availability, and How to Apply

Data retention is required for enrolled organizations so Anthropic can monitor for cyber misuse. Once Enterprise Frontier Safeguards (EFS)—a solution combining zero data retention privacy with robust safeguards—becomes available later this fall, eligible organizations will be able to store data in cloud infrastructure they control. Until then, organizations with access to Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can also use CVP with zero data retention.

CVP is available on the Claude Platform, Google Cloud's Vertex AI, and Microsoft Foundry. On Amazon Bedrock, CVP is only available to customers eligible for Enterprise Frontier Safeguards. Existing CVP members keep current settings for previous models and are automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 through the updated program; admins must assign access to specific workspaces.

What to Watch

Anthropic says it will continue refining its tier-based classifiers and will share more in the coming weeks about its open-source and critical infrastructure security work. The key question is whether tiered safeguard tuning can scale defensive access without widening the door for misuse—and whether the EFS rollout this fall delivers the zero-data-retention privacy that many enterprise security teams require before enrolling.