Artificial Intelligence
Anthropic expands its Cyber Verification Program
Anthropic broadened its Cyber Verification Program into three access tiers for security work, while citing benchmark testing, vulnerability totals and tighter controls for higher-risk use.
- Anthropic launched an expanded Cyber Verification Program with three access tiers for qualifying security professionals.
- The company said the tiers would provide access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models.
- Anthropic said Project Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, and its own scanning found 5,500 more between April and October 2026.
- Anthropic said it reviewed every organisation for Specialized Access in depth with the US government.
- In its CyScenarioBench testing, Anthropic said every task was blocked without CVP access, 46 of 50 trials were blocked in Defense Access, and 34 of 50 succeeded in Red Team Access.
Anthropic said it had merged Project Glasswing and its Cyber Verification Program into a single, larger offering. It said the updated programme gave qualifying security professionals access to advanced cyber functions and fewer blocking controls, split across three tiers.
The company said Defense Access covered defensive work such as incident response, malware reverse engineering and vulnerability analysis. It said Red Team Access added authorised penetration testing, while Specialized Access was reserved for a small group of verified organisations testing sensitive systems.
Anthropic said the programme still blocked harmful actions, including ransomware deployment, physical damage and some tests on high-risk safety systems. It also said its general models remained suitable for code review, patching, vulnerability discovery in owned code and alert triage.
To assess the controls, Anthropic ran Claude Opus 5.5 through CyScenarioBench and reported different results by tier. It also said Project Glasswing partners found at least 129,000 verified vulnerabilities from April to July 2026, its own open-source scanning found 5,500 more through October 2026, and some partners, including Booz Allen and Comcast, said Claude Mythos shortened discovery work by months or years.
Named in this story
Companies
- Anthropic
- launched the expanded Cyber Verification Program
- Booz Allen
- one of the partners Anthropic cited on vulnerability-finding experience
- Comcast
- one of the partners Anthropic cited on vulnerability-finding experience
Governments and agencies
- US government
- worked with Anthropic on in-depth review for the top tier
Products and systems
- Cyber Verification Program
- the access programme Anthropic expanded into three tiers
- Project Glasswing
- the earlier access programme folded into the new offering
- Claude Opus 5.5
- one of the models made available through the tiers
- Claude Sonnet 5.5
- one of the models made available through the tiers
- Claude Mythos 5.1
- one of the models made available through the tiers
- Claude Fable 5.1
- a generally available model Anthropic said kept conservative safeguards
- Enterprise Frontier Safeguards
- a forthcoming solution Anthropic said would combine privacy with safeguards
- CyScenarioBench
- the evaluation Anthropic used to test the tiered safeguards
How the source tells it
The piece read like a company launch and victory lap, with repeated claims about capability, safety controls and defender gains.
- vendor boosterism first-person promotion and repeated claims about the programme’s benefits and impact
- reassurance safeguards, blocking controls and government review were emphasised throughout
- hype new tiers and the ‘most capable’ models were presented as a significant expansion