Anthropic folded its half-year-old Project Glasswing into the Cyber Verification Program on October 6, launching an expanded CVP that grants vetted security teams tiered access to Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1 — with cyber safeguards relaxed as teams climb Defense, Red Team, and Specialized tiers.

Two parallel programs become one

Until this week, Anthropic was running two distinct cyber-review mechanisms side by side. Project Glasswing, launched in April, gave around 50 vetted organizations — including Apple, Amazon, Google, Microsoft, and NVIDIA — early access to Claude Mythos for protecting critical software infrastructure. The CVP, by contrast, had been softening cyber-blockers on Claude Opus and Claude Sonnet and giving generically vetted security teams a path to dig deeper into those models. By the time Claude Opus 5.5 shipped on September 22, the two programs were already colliding: most security requests were being routed to the older Opus 4.8 for safety reasons, and Opus 5.5's full cyber capability was being throttled by the conservative classifier baked into the generally available model.

The expanded CVP replaces that workaround with a three-tier structure:

  • Defense Access covers SOC work, incident response, malware reverse-engineering, and vulnerability validation. Eligible applicants include security teams at companies, nonprofits, universities, and government bodies defending systems they own or maintain; operators of regional hospitals and municipal utilities; open-source maintainers; and individual researchers with a track record. Anthropic expects most defensive-security organizations to qualify, and targets a review window of days.
  • Red Team Access layers in authorized penetration testing and red-teaming. Applicants include in-house red teams, government red teams, and security or pentest firms. Anthropic still blocks real-time requests for ransomware deployment or physical-system damage, and reviews take several weeks. Individual researchers are not yet eligible at this tier.
  • Specialized Access is the narrowest layer, reserved for organizations authorized to test safety-critical systems such as power grids, telecom networks, interbank-transfer infrastructure, and government administrative networks. Each applicant is reviewed in depth in collaboration with the US government. Existing Glasswing members transition in without re-approval for current models.

129,000 vulnerabilities as the audit trail

The merger rests on six months of empirical evidence. Glasswing partners verified at least 129,000 software vulnerabilities between April and July 2026; Anthropic's own open-source scanning added 5,500 between April and October, bringing the total to 134,500 verified vulnerabilities, of which more than 33,000 were rated critical or high severity. That headline number is conservative — it is built from only 33 partner reports, fewer than half of which disclosed patch counts (often because fixes were still in progress), and Anthropic estimates the true impact is at least five times higher. Booz Allen and Comcast published partner case studies showing Mythos lifted their vulnerability-finding rate by months or even years.

CyScenarioBench results pin the tier boundaries

To confirm the tiers actually behave as advertised, Anthropic ran Claude Opus 5.5 through CyScenarioBench — an internal evaluation that measures a model's ability to plan and execute multi-stage cyber operations under realistic constraints. Five attempts per challenge, ten challenges, fifty trials per tier:

  • Without CVP access: all 50 trials were blocked on the first prompt.
  • Defense Access: 46 of 50 trials were blocked at some point; the remaining 4 completed.
  • Red Team Access: zero blocks. The model completed 34 of 50 tasks — identical to its 67.6% unsafeguarded baseline, which is what Specialized Access also delivers.

In effect, Red Team is the tier where the classifiers are effectively turned off. The model behaves as if no safety net is in place — a tradeoff Anthropic frames as "the same capabilities that let a security team find and fix a vulnerability can also help a malicious actor exploit it." The classifiers, instead of being removed entirely, are tuned per identity, organization, use case, and potential impact.

Platforms, data retention, and what comes next

The expanded CVP is available on Claude Platform, Google Cloud Vertex AI, and Microsoft Foundry. Amazon Bedrock participation is reserved for customers eligible for Enterprise Frontier Safeguards (EFS), scheduled to ship later this fall; EFS will let qualifying customers retain data inside cloud infrastructure they control. Until EFS lands, all three tiers require data retention so Anthropic can monitor for misuse — and only organizations already using Claude Fable 5.1 or Mythos 5.1 with zero data retention can keep that posture inside CVP.

Personal take: from a wall to a door

Anthropic sits in a uniquely uncomfortable position — it ships some of the most capable models in the world, and it carries first-responder responsibility for the dual-use risk those same models create. Six months of Glasswing data showed that Mythos, handed to genuine defenders, can move the global critical-software vulnerability backlog by orders of magnitude. The default model, meanwhile, keeps getting more cautious and more locked-down — which only protects attackers, who do not need Anthropic's API to use AI.

The three-tier CVP is Anthropic's translation of that paradox into something concrete: identity-aware gates, instead of a flat wall. Defense stays open to most compliant organizations. Red Team is gated but reachable for authorized testers. Specialized is gated jointly with the US government for power grids, telecom, and interbank infrastructure — the systems where an AI failure would hurt people or markets, not just balance sheets.

It is not a perfect solution. Fewer than half of Glasswing partners disclosed patch counts, and the data-retention requirement is real friction for security teams that need zero-retention posture. But it pulls apart a stale assumption — "AI cannot do cyber" — and replaces it with a more useful one: "AI, once identified, can do cyber at the tier it has earned."

The questions to watch are whether EFS opens up the Bedrock path on time, and whether OpenAI or Google adopt a similar tiered structure. If they do, the cyber-defense landscape in 2027 will look nothing like the last decade — provided Anthropic can hold the line on tiering instead of getting pressured back into a flat default-off posture.