Anthropic Cyber Verification Program adds 3 tiers

Project Glasswing and Claude Mythos fold into the CVP

The Cyber Verification Program is how Anthropic lets screened security teams do cyber work that its public models turn down. The October 6 update pulls Project Glasswing, the group of organizations that had Claude Mythos, inside the CVP, so the same three models are now available at every tier. What changes from tier to tier is how much offensive work gets through and how hard the vetting is.

Why the Claude API blocks most cyber defense work by default

Security skills cut both ways. The knowledge a defender uses to find and patch a flaw is the same knowledge an attacker needs to exploit it, which is what people mean by dual use.

That is why Opus 5.5, Fable 5.1 and Sonnet 5.5 ship with conservative cyber safeguards that stop most cyber tasks. Classifiers watch requests and block the risky ones. Everyday security chores still work on the standard models: reviewing code, fixing known issues, hunting for bugs in source code you own, and triaging alerts.

Claude Opus 5.5 and Claude Mythos access before the merger

For the past six months, defenders got access through two separate programs. Glasswing handed Claude Mythos to a small circle of organizations guarding critical software, and the original CVP relaxed safeguards on Opus and Sonnet for approved security teams.

Folding them together means any team that clears CVP review can now reach Mythos, not just Glasswing partners. How Mythos got here, including the June export-control pause, is covered in Claude Mythos 5 Returns for Critical Infra.

Which tier fits your red team or incident response work?

Pick Defense Access if your team protects its own systems through SOC work, incident response, malware analysis or vulnerability triage. Choose Red Team Access if you run authorized penetration tests for yourself or clients. Only organizations cleared to test safety-critical infrastructure, such as grids or flight systems, belong in Specialized Access.

Defense Access covers incident response and malware analysis

Defense Access is the defensive tier. It unlocks security operations center tasks, incident response, malware reverse engineering, and the analysis and validation of vulnerabilities.

Anthropic expects many defensive teams to qualify, including critical infrastructure operators of any size, such as a regional hospital or a city utility. Security teams at companies, nonprofits, universities and government bodies can apply, as can smaller security firms, open-source maintainers and individual researchers with a record of reported vulnerabilities. Anthropic aims to answer within a few days.

Red Team Access adds penetration testing, blocks ransomware

Red Team Access keeps everything in Defense Access and adds authorized penetration testing and red-teaming, meaning simulated attacks against systems you have permission to probe. That can include IT systems in critical industries.

Even here, Claude still refuses in real time to deploy ransomware, damage physical systems or pen test high-risk safety systems. Reviews take a few weeks, and applicants sit in Defense Access while they wait. The tier is closed to individual researchers for now.

Specialized Access is for critical infrastructure security teams

Specialized Access has the fewest blocks. It is meant for a small number of organizations authorized to test systems whose failure could hurt people or disrupt markets: flight operating systems, power grids, telecom networks, interbank transfer rails and government administrative networks.

Every applicant is vetted in depth together with the US government. Current Glasswing members are moved into this tier automatically and do not need fresh approval for current models.

How the CyScenarioBench AI benchmark separates the tiers

CyScenarioBench checks whether a model can plan and carry out a multi-step cyberattack under realistic limits. Anthropic ran Claude Opus 5.5 through it under each tier's safeguards, and the blocks fell away as the tiers went up. Because every scenario is offensive, heavy blocking in the lower tiers was the expected result.

Defense Access stopped Claude Opus 5.5 in 46 of 50 trials

Under Defense Access, 46 of the 50 attempts were cut off partway through, and the other four ran to completion. With no CVP access at all, the safeguards shut down every task on the very first prompt.

Red Team Access matched AI red teaming without safeguards

Red Team Access produced zero blocks, and Opus 5.5 completed 34 of 50 tasks. That lines up with the 67.6% success rate the model reaches with no safeguards, so the Red Team classifiers leave offensive testing ability almost untouched. Anthropic says these numbers give it confidence to hand advanced cyber capabilities to a much wider group of defenders, and that it will keep tuning the tier classifiers.

Anthropic Glasswing partners found 129,000 software vulnerabilities

Between April and July 2026, organizations in Glasswing found at least 129,000 verified vulnerabilities. Anthropic's own open-source scanning added 5,500 more from April through October, and over 33,000 of the combined total have been rated critical or high severity.

Anthropic calls these figures a lower bound. They rest on partial data from 33 partner reports and its open-source work, and fewer than half the partners disclosed how many bugs they had patched. The company expects the real impact to be at least five times larger.

Data retention and phishing-resistant MFA rules to plan for

Every tier requires data retention so Anthropic can monitor for misuse, with one narrow exception. Before applying, security leads will want to decide whether SOC transcripts and pen-test sessions can sit in Anthropic's logs.

Organizations apply once through the Verification Portal, and admins hand out seats afterward. Independent researchers, maintainers and bug bounty hunters apply on their own, but individuals can only get Defense Access and need a paid Claude plan.

Zero data retention customers wait for Enterprise Frontier Safeguards

Zero data retention (ZDR) means Anthropic keeps none of what you send. The CVP generally does not allow it, with one stopgap: teams that already use Claude Fable 5.1 or Claude Mythos 5.1 under ZDR can run the program under ZDR too. That exception lasts until Enterprise Frontier Safeguards (EFS) arrives later this fall, after which eligible organizations can keep the retained data in cloud infrastructure they control.

Defense Access must replace API keys with workload identity federation

Defense Access members have until December 15, 2026 to switch to phishing-resistant MFA and stop using API keys. Until that date, any form of MFA is required and API keys expire every seven days. The Help Center recommends moving to Workload Identity Federation now rather than waiting for the deadline.

Amazon Bedrock, Vertex AI and Microsoft Foundry availability

The CVP runs on the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. Amazon Bedrock is the exception: it cannot yet send automated safety flags to human review, so only Bedrock customers with a Fable 5.1 data retention exemption qualify. Specialized Access is not offered through third-party platforms at all.

Approval alone does not switch anything on. What the owner does next depends on how the organization uses Claude:

• Claude Console and API organizations: the owner assigns the program to workspaces
• Claude Enterprise: the owner assigns it to a custom role
• Claude Team, Max and Pro: nothing to do

Mythos reaches third-party clouds about five business days after approval. Existing CVP members keep their settings for older models and are evaluated automatically for the new ones.