On October 6, 2026, Anthropic announced an expanded Cyber Verification Program (CVP) that provides vetted security professionals graded access to its most capable models — including Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 — with reduced blocking classifiers for qualifying users. The program is organized into three tiers so security teams can apply for the level of access appropriate to their work; each tier carries distinct verification requirements and security controls.
The three access tiers
-
Defense Access: Intended for defensive use such as security operations center (SOC) work, incident response, reverse-engineering malware, and analyzing and validating vulnerabilities. Anthropic lists qualifying organizations as corporate, nonprofit, university and government security teams defending systems they own or operate; operators of critical infrastructure of any size (for example regional hospitals or municipal utilities); smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. Anthropic expects many organizations doing defensive cybersecurity work to qualify and aims to respond to applications within a few days.
-
Red Team Access: Adds authorized penetration testing and red-teaming to the defensive uses allowed by Defense Access. Examples of qualifying entities include in-house red teams, government red teams, and security and penetration testing firms. Organizations in this tier may only test systems they are explicitly authorized to test, including IT systems in critical industries. Real-time blocks will remain for actions that could cause physical harm or mass disruption (for example deploying ransomware, damaging physical systems, or pen-testing high-risk safety systems). Due to higher eligibility requirements and security controls, Anthropic expects reviews of Red Team Access applications to take a few weeks; applicants will be enrolled in Defense Access while their Red Team application is reviewed. Currently this tier is limited to organizations; individual researchers are not eligible.
-
Specialized Access: The least-restricted tier, reserved for a limited set of verified organizations authorized to test safety-critical systems that could affect lives or disrupt markets — such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. Anthropic currently reviews organizations in this tier in depth in collaboration with the U.S. government. Existing Project Glasswing members will transition into this tier without reapproval for the current models.
Public models and allowed tasks
Anthropic’s generally available models (for example Claude Opus 5.5, Claude Fable 5.1, Claude Sonnet 5.5) retain conservative cyber safeguards. These models remain usable for tasks like code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts, but they block most cyber work by default to reduce the risk of misuse.
Evaluation results: CyScenarioBench
Anthropic evaluated Claude Opus 5.5 using CyScenarioBench — an assessment that measures whether models can plan and execute multi-stage cyber operations under realistic constraints — with safeguards tuned for each CVP tier. Key outcomes reported:
- With no CVP access (public models), every task was blocked on the first prompt.
- In the Defense Access tier, 46 out of 50 trials were blocked at some point during the challenges; four tasks succeeded.
- In the Red Team Access tier, no blocks occurred, and Claude Opus 5.5 successfully completed 34 of the 50 tasks — roughly matching the model’s 67.6% success rate when no safeguards are applied (representative of Specialized Access).
Anthropic says these results support making advanced cyber capabilities available to a broader set of defenders while continuing to refine tier-based classifiers.
Project Glasswing outcomes and vulnerability numbers
Anthropic reports that partners using Claude Mythos models in Project Glasswing uncovered at least 129,000 verified software vulnerabilities between April and July 2026. In addition, Anthropic’s open-source scanning efforts found 5,500 verified software vulnerabilities between April and October 2026. Of these verified vulnerabilities, more than 33,000 have so far been rated critical- or high-severity. Anthropic notes these figures are likely undercounts because they rely on survey data from a subset of Glasswing partners and partial disclosures; the company estimates the true impact could be at least five times greater.
Several partners told Anthropic that finding the same number of vulnerabilities without Claude Mythos models would have taken months or years longer. Anthropic cites partner experiences from organizations such as Booz Allen and Comcast.
Data retention and Enterprise Frontier Safeguards (EFS)
Organizations enrolled in CVP are currently required to retain data so Anthropic can monitor for cyber misuse. Anthropic plans to offer Enterprise Frontier Safeguards (EFS) later in the fall, a solution that combines zero data retention with robust safeguards and lets eligible organizations store data in cloud infrastructure they control. Until EFS becomes available, organizations with access to Claude Fable 5.1 or Claude Mythos 5.1 in zero-data-retention mode may use CVP with zero data retention.
How to apply and supported platforms
Interested organizations can apply to the CVP; Anthropic will verify applicants and request proof of required security controls for the requested access tier. Existing CVP members retain their previous settings for models and will be automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 under the updated program. Administrators must assign access to specific workspaces per the program’s procedures.
The CVP is available on the Claude Platform, Google Cloud’s Vertex AI, and Microsoft Foundry. On Amazon Bedrock, CVP access is limited to customers eligible for Enterprise Frontier Safeguards.
Anthropic says it will continue refining controls and classifiers; users who encounter unexpected blocks for actions they believe their tier should allow can report those incidents through the program’s reporting channel. Full details for each tier and the program’s help materials are available from Anthropic’s support resources.
