Anthropic Cyber Verification Program: Three Access Tiers

Two programs become one

Anthropic's generally available models, Claude Opus 5.5, Fable 5.1 and Sonnet 5.5, carry cyber safeguards that block most cyber work, because the same help that lets a defender find and fix a flaw can help an attacker exploit it. For six months Anthropic had offered two ways around that. Project Glasswing gave a group of organizations securing critical software access to Claude Mythos, and the original Cyber Verification Program gave vetted security teams reduced safeguards on Opus and Sonnet models. [1]

On October 6, 2026, Anthropic merged the two into one program with three tiers. Every tier includes Opus 5.5, Sonnet 5.5, Claude Mythos 5.1 and future models. The tiers differ in how much cyber work the classifiers block and how much verification and security control an organization must accept. CSO Online's report, published the next morning in India, carried the same structure and Anthropic's statement that the change was meant to extend Glasswing to many more defenders. [1][2]

Defense, Red Team and Specialized Access

Defense Access covers security operations and incident response, malware reverse engineering, and analyzing and validating vulnerabilities. Anthropic named security teams at companies, nonprofits, universities and government bodies, critical infrastructure operators of any size such as regional hospitals and municipal utilities, small security firms, open-source maintainers and individual researchers with a record of reported vulnerabilities as examples of who qualifies, and said it aimed to answer applications within a few days. [1]

Red Team Access adds authorized penetration testing and red-teaming against systems the organization is allowed to test. It is open to organizations only, not individual researchers, reviews take a few weeks, and applicants are placed in Defense Access meanwhile. Real-time blocks still apply to actions that could cause physical harm or mass disruption, such as deploying ransomware or testing high-risk safety systems. [1]

Specialized Access has the fewest blocks and is reserved for a limited set of organizations authorized to test systems such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. Anthropic said it reviews each of these organizations in depth together with the US government, and existing Glasswing members moved into this tier without reapproval for current models. [1]

Retention and platform terms

Enrolled organizations must allow data retention so Anthropic can watch for cyber misuse. Anthropic said a product called Enterprise Frontier Safeguards, due later in the fall, would let eligible organizations keep that data in cloud infrastructure they control; until then, organizations already using Fable 5.1 or Mythos 5.1 under zero data retention could join on the same terms. The program runs on Anthropic's own platform, Google Cloud's Vertex AI and Microsoft Foundry, and on Amazon Bedrock only for customers eligible for Enterprise Frontier Safeguards. [1]

Anthropic's test of the tiers

Anthropic ran Claude Opus 5.5 five times on each of the 10 challenges in CyScenarioBench, a test of multi-stage cyber operations, with safeguards set for each tier. Without the program every task was blocked on the first prompt. Under Defense Access 46 of 50 trials were blocked at some point. Under Red Team Access nothing was blocked and the model completed 34 of 50, which Anthropic said matched its success rate with no safeguards at all. [1]

The post also reported that Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, and Anthropic's own open-source scanning another 5,500 between April and October, with more than 33,000 of the total rated critical or high. Anthropic said these figures come from 33 partner reports, that fewer than half of partners disclosed patch numbers, and that it expects the true impact to be at least five times higher. [1]

Both sets of numbers are Anthropic's own: the benchmark shows its classifiers behaving as designed on one test, and the vulnerability counts rest on partner self-reports. The structural change is easier to state. Mythos-class access stopped being a matter of invitation and became something a qualifying security team could apply for, with the US government in the loop only for the most permissive tier. [1][2]