Anthropic has expanded its Cyber Verification Program (CVP) into three access tiers, merging its earlier trusted-access efforts, Project Glasswing and the original CVP, into a single offering. The tiers are Defense Access, Red Team Access, and Specialized Access, each with different verification requirements and security controls. All tiers include access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. The expansion reflects the dual-use nature of cybersecurity: generally available models keep conservative safeguards that block most cyber work, while verified security professionals can apply for reduced blocking to defend systems.

Defense Access is for defensive security work such as security operations center and incident response tasks, reverse-engineering malware, and analyzing/validating vulnerabilities. Qualifying organizations include security teams at companies, nonprofits, universities, and government bodies defending systems they own or maintain; critical infrastructure operators; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. Red Team Access adds authorized penetration testing and red-teaming, and is open to in-house red teams, government red teams, and security/testing firms; it is organizations-only, and users still face real-time blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or pen testing high-risk safety systems. Specialized Access has the fewest cyber blocks and is limited to verified organizations authorized to test safety systems that could affect lives or markets—flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. These organizations are reviewed in depth in collaboration with the US government, and existing Project Glasswing members transition to this tier without reapproval for current models.

Applicants to Red Team Access are enrolled in Defense Access during review, and while Defense Access applications are expected to receive responses in a few days, Red Team Access reviews can take a few weeks. Organizations enrolled in CVP are subject to data retention for cyber-misuse monitoring. Later this fall, Enterprise Frontier Safeguards (EFS) will allow eligible organizations to store data in cloud infrastructure they control; until then, organizations with access to Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can also use CVP with zero data retention.

To test the tier protections, Anthropic ran Claude Opus 5.5 through CyScenarioBench, an evaluation of whether models can plan and execute multi-stage cyber operations under realistic constraints. Across five attempts at each of 10 challenges per tier, without CVP access every task was blocked on the first prompt. In Defense Access, safeguards blocked 46 of 50 trials, with four tasks succeeding. In Red Team Access, no blocks occurred and Claude Opus 5.5 completed 34 of 50 tasks, effectively matching the model’s 67.6% no-safeguards success rate, which is representative of Specialized Access.

The post also shares impact data from Project Glasswing. Between April and July 2026, partners uncovered at least 129,000 verified software vulnerabilities; Anthropic’s own open-source scanning added 5,500 verified vulnerabilities between April and October 2026. More than 33,000 of these verified vulnerabilities have been rated critical- or high-severity. Anthropic says these numbers are likely an undercount because they are based on survey data from only a subset of partners, and estimates the true impact is at least five times higher. Several partners reported that the models increased their vulnerability-finding rate by months or even years; fewer than 50% of partners disclosed patched numbers, often because fixes were still in progress, so the patch rate is also significantly undercounted.

CVP is available on the Claude Platform, Google Cloud’s Vertex AI, and Microsoft Foundry; on Amazon Bedrock it is limited to customers eligible for Enterprise Frontier Safeguards. Existing CVP members keep their current settings for previous models and are automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 through the updated program, with admins needing to assign access to specific workspaces. Organizations can apply directly, and Anthropic will verify applicants and request proof of required security controls for the relevant tier.