Anthropic PBC today expanded its Cyber Verification Program into three tiers of access for vetted security teams, with fewer blocks on cybersecurity work at each step up.
The overhaul is aimed at a restriction Anthropic built into its own products. Because the company treats cybersecurity as dual-use, its generally available models carry conservative classifiers that block most cyber work. When Claude Opus 5.5 launched Sept. 22, most security tasks sent to it were routed to the older Opus 4.8.
Anthropic is folding Project Glasswing into the program at the same time. Since April, Glasswing has given Claude Mythos access to organizations that secure critical software, and Anthropic widened it to 150 more organizations in June. Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 are available at every tier of the new structure, and later models will be added as they ship.
Defense Access is the entry tier, meant for defensive jobs such as incident response and malware reverse engineering. Security teams defending systems they own or maintain qualify, whether they work for a company, a university or a government body.
Individual researchers with a record of reported vulnerabilities can apply too, as can critical infrastructure operators as small as a regional hospital. Anthropic expects many organizations doing defensive work to qualify and is aiming to respond to applications within a few days.
Red Team Access opens up authorized penetration testing and red-teaming against systems an organization has permission to test. Even at this level, Anthropic’s classifiers block requests in real time when the work moves toward something like deploying ransomware. Applicants wait a few weeks for a review and sit in the Defense Access tier in the meantime, and individual researchers are shut out of the tier for now.
Specialized Access carries the fewest cyber blocks of the three. Only organizations cleared to test safety systems like power grids and telecom networks qualify, since failures there could put lives at risk or disrupt markets. Anthropic vets each of them in depth with the U.S. government, and existing Glasswing members move straight into the tier without reapproval for current models.
Enrolled organizations must allow data retention so Anthropic can watch for misuse. Enterprise Frontier Safeguards, due later this year, will let eligible customers keep that data in cloud infrastructure they control.
Anthropic tested the tiers on the multistage cyber operations benchmark CyScenarioBench, with Claude Opus 5.5 running each of its 10 challenges five times. Every attempt without program access was blocked on the first prompt. Because the scenarios are offensive, Anthropic had expected heavy blocking in the Defense Access tier, where 46 of the 50 runs were stopped at some point.
At the Red Team level nothing was blocked and the model finished 34 of its 50 runs. Anthropic said that result is effectively the same as the model’s 67.6% success rate with no safeguards applied.
Outside the lab, the argument for widening access comes from the Mythos program the new structure absorbs. Partners in Project Glasswing found at least 129,000 verified vulnerabilities between April and July, and Anthropic’s own scanning of open-source code turned up 5,500 more through October. Of that combined total, more than 33,000 have been rated critical or high severity.
The figures draw on just 33 partner reports, and the company said the true impact is likely at least five times higher. Fewer than half of the partners disclosed patch counts, often because fixes were still underway.
The program is available through the Claude Platform, Google LLC’s Vertex AI and Microsoft Corp.’s Foundry service. On Amazon Web Services Inc.’s Bedrock, it is limited to customers eligible for Enterprise Frontier Safeguards.