Anthropic expands its Cyber Verification Program: Glasswing folded in, stronger cyber capabilities granted in three tiers

Why it matters

Key points

Anthropic expanded its Cyber Verification Program (CVP) early on October 7 Beijing time (October 6 in the US), folding in Project Glasswing, which had given a small group of critical-software organizations access to Claude Mythos. The program now has three access tiers that give vetted security teams stronger cyber capabilities with fewer classifier blocks. Every tier includes Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models.

Defense Access covers defensive work such as security operations, incident response, malware reverse engineering and vulnerability analysis. Corporate security teams, nonprofits, universities, government bodies, critical-infrastructure operators of any size, smaller security firms, open-source maintainers and individual researchers with a record of reported vulnerabilities can apply, and Anthropic aims to respond within days. Red Team Access adds authorized penetration testing and red-teaming, is open to organizations only, applies only to systems they are authorized to test, still blocks actions like deploying ransomware or damaging physical systems in real time, and takes weeks to review. Specialized Access has the fewest blocks and is reserved for a few organizations authorized to test high-risk systems such as flight operations, power grids, telecom networks, interbank transfers and government networks; each is reviewed in depth with the US government, and existing Glasswing members move into this tier.

Enrolled organizations must allow data retention so Anthropic can monitor for misuse; Enterprise Frontier Safeguards (EFS), due later this fall, will let eligible organizations keep data in cloud infrastructure they control. Generally available models can still be used for code review, patching known issues, finding vulnerabilities in owned code and triaging alerts.

Verifiable

Official announcement: https://www.anthropic.com/news/cyber-verification-program , dated October 6, 2026 (US); the page's structured data gives 19:00 UTC that day.

To test the safeguards, Anthropic ran Claude Opus 5.5 five times on each of 10 CyScenarioBench challenges, an evaluation of whether a model can plan and carry out multi-stage cyber operations under realistic constraints. Without CVP every task was blocked on the first prompt; in Defense Access 46 of 50 trials were blocked partway; in Red Team Access nothing was blocked and 34 of 50 succeeded, essentially matching the 67.6% success rate with no safeguards. Anthropic also says Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, its own open-source scanning found another 5,500 between April and October, and more than 33,000 were rated critical or high severity. All figures are self-reported, and the evaluation was designed and run by Anthropic.

Our take

The significance is not that more people get access, but that frontier labs are changing how dangerous capabilities are handed out: from blanket blocking to tiered access based on who you are. The closer models get to running multi-stage attacks on their own, the more conservative the public versions must be, and the real capability increasingly sits behind verification. OpenAI's Daybreak, Google's defenders-first Gemini 4 Argon and this CVP follow the same path: cybersecurity is the first field where your verified identity decides how strong a model you can use.

Two things are worth watching. The top tier is reviewed case by case with the US government, which means the strongest offensive and defensive capabilities are already being treated as quasi-controlled goods, and how much non-US organizations can get will become a new asymmetry. And because Red Team Access performs on the evaluation as if there were no safeguards at all, protection rests entirely on vetting at the door and monitoring afterward, which is why data retention is mandatory. For defenders, the bar is lower and the available capability higher, but the rules on who qualifies are still set entirely by the vendor.