Anthropic expands Claude access and cites 129,000 flaws

Anthropic said it had widened the Cyber Verification Program for approved security teams. The programme offered three access levels and included Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1.

The company said the first tier covered defensive work such as incident response, malware analysis and vulnerability checking. The second added authorised penetration testing and red-teaming, while the third was limited to a small set of verified organisations that were allowed to test safety systems.

In testing reported by Anthropic, CyScenarioBench blocked 46 of 50 tasks on Claude Opus 5.5 in the defensive tier. On the same model, the red-team tier completed 34 of 50 tasks, and the article said all tasks were blocked before CVP access was used.

Anthropic said Project Glasswing found at least 129,000 verified software vulnerabilities from April to July 2026. It said open-source scanning found another 5,500 between April and October 2026, and that more than 33,000 of the verified flaws were rated critical or high; it also said that figure was probably low because it came from only some partners.

Patrick Garrity of VulnCheck said in a late-September analysis that only two of the 300 vulnerabilities found by Anthropic or Project Glasswing had been exploited in the wild. He identified those as CVE-2026-26980 in Ghost CMS and CVE-2026-61500 in Rejetto HTTP File Server, and the article also cited Veracode as saying 44% of AI code generation tasks introduced a risky vulnerability in tests.