Anthropic is significantly broadening its Cyber Verification Program, allowing more security teams to tap into advanced cyber capabilities with fewer restrictions on its leading AI models. This initiative arrives at a time when effective cybersecurity tools are paramount.
The revamped program introduces three different access tiers tailored to the nature of cybersecurity efforts an organization is permitted to conduct. These tiers are designed for defensive security tasks, authorized red teaming, and testing systems with potential ramifications for public safety or financial stability.
“Defenders also need access to the best tools and most powerful capabilities to secure their systems,” Anthropic stated in their official announcement.
The company's currently available models utilize conservative safeguards that typically inhibit most cyber attacks. Anthropic explained that these precautions are aimed at preventing harmful actions as they continue to refine their methodology to minimize false positives in secure coding environments.
Integrating Glasswing and CVP
This new iteration of the program merges two recent initiatives: Project Glasswing and an earlier version of the Cyber Verification Program. Project Glasswing granted selected organizations involved in securing crucial software the ability to use Claude Mythos, while the existing CVP provided approved security teams access to Claude Opus and Claude Sonnet models with modified safeguards.
“The updates we're making to our Cyber Verification Program are directed at expanding the reach of Project Glasswing to a broader array of cyber defenders,” Anthropic elaborated.
Current members of Glasswing will transition into the Specialized Access tier without needing to reapply for their models. The Defense Access tier focuses on defensive activities such as security operations and incident response, while the Red Team Access tier grants permission for authorized penetration testing.
Those in the Specialized Access tier face the least restrictions, designated for a limited number of verified organizations that are allowed to probe environments like flight control systems and telecommunication infrastructures. Verification for this tier is conducted with input from the US government.
Evaluating Tier Effectiveness
Anthropic undertook a series of evaluations across these access levels, utilizing CyScenarioBench—a framework designed to assess how well AI models can strategize and execute multistage cyber operations. Claude Opus 5.5 was put through ten challenges, with five attempts made for each tier.
The findings were notable. All 50 trials were blocked without CVP access, while under the Defense Access tier, 46 trials encountered blocks, allowing only four to succeed. Conversely, in the Red Team Access tier, none of the challenges were obstructed, with Claude achieving a successful outcome in 34 trials; this success rate mirrored its favored results when no safeguards were in place.
Sakshi Grover, research director at IDC, cautioned that such evaluations should be contextualized since they are vendor-driven and not independently verified. She emphasized the importance of authorization and scope when applying AI in security testing.
“The legitimacy hinges on authorization and the conditions surrounding the target,” Grover remarked.
Need for Comprehensive Controls
Experts agree that organizations must establish frameworks beyond the AI models themselves, especially when permissions are loosened. Grover highlighted the significance of implementing controls that lie outside the model.
Specific recommendations include assigning unique identities to agents, granting temporary privileges for particular tasks, and independently validating targets and actions. Deepika Giri of IDC underlined the value of treating AI agents as privileged employees: “They should have distinct identities and limited access for specific assignments, with full oversight of their activities.”
Further emphasizing accountability, cybersecurity researcher Vibhum Dubey stated it's essential for organizations to clarify responsibility for the actions undertaken by autonomous systems.
Anthropic reported that Project Glasswing associates identified over 129,000 verified software vulnerabilities between April and July 2026. Additional open-source scanning revealed another 5,500 vulnerabilities in the same period. Remarkably, over 33,000 have been classified as critical or high severity, although Anthropic suggested this figure might be an underestimation.
Organizations participating in the CVP will also be subject to data retention monitoring to detect any cyber misuse. Anthropic plans to introduce its Enterprise Frontier Safeguards service, enabling qualifying organizations to merge zero-data-retention capabilities with enhanced safeguards while storing data within their controlled cloud infrastructure.
