Anthropic expands its Cyber Verification Program into three access tiers, opening advanced cyber capabilities to more defenders

Anthropic's stated rationale is direct: cybersecurity is inherently dual use. The same capability that lets a security team find and fix a vulnerability can also help a malicious actor exploit it. For that reason the generally available models, Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5, keep conservative cyber safeguards that block most cyber work. Anthropic says this limits what malicious actors can do while it keeps working to reduce false positives for secure coding. But defenders also need the best tools, which is what this expansion addresses. All three tiers can access Anthropic's most capable models, including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, plus new models moving forward.

The three tiers step from defensive work to adversarial testing to high-stakes systems. Defense Access covers defensive work: security operations center and incident response tasks, reverse-engineering malware, and analyzing and validating vulnerabilities. Qualifying organizations include security teams at companies, nonprofits, universities and government bodies defending systems they own or maintain; operators of critical infrastructure of any size, such as regional hospitals or municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. Anthropic aims to respond within a few days. Red Team Access adds authorized penetration testing and red teaming to the defensive uses, covering in-house red teams, government red teams and security and penetration testing firms. This tier can only perform adversarial testing against systems it is authorized to test, and real-time blocks still apply to actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems or pen testing high-risk safety systems. Given stricter eligibility and controls, Anthropic expects applications to take a few weeks to review, and the tier is currently for organizations only, with individual researchers not eligible. Specialized Access has the fewest cyber blocks and is reserved for a limited set of verified organizations authorized to test systems that could impact people's lives or disrupt markets, with flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks given as examples. This tier is reviewed in depth in collaboration with the US government.

To test whether tiered safeguards hold up, Anthropic ran an evaluation called CyScenarioBench, which measures whether models can plan and execute multi-stage cyber operations under realistic constraints. The company tested Claude Opus 5.5 with safeguards tuned for the different CVP tiers, five attempts at each of the 10 challenges per tier, 50 trials in total. The results came in three bands: without CVP access, every task was blocked on the first prompt; in the Defense Access tier, 46 of 50 trials were blocked at some point in the challenge, with the remaining four tasks succeeding; in the Red Team Access tier, no blocks occurred and Claude Opus 5.5 completed 34 of 50 tasks, which Anthropic says is effectively equivalent to the model's 67.6% success rate with no safeguards applied, the case that represents Specialized Access. Anthropic says these results give it confidence to make advanced cyber capabilities safely available to a broader set of defenders, and that it will keep refining the tier-based classifiers.

The other set of official numbers comes from Project Glasswing's real-world effect. Anthropic says partners in the program uncovered at least 129,000 verified software vulnerabilities between April and July 2026, and that Anthropic's own open-source scanning found an additional 5,500 verified vulnerabilities between April and October 2026. Of those verified vulnerabilities, more than 33,000 have so far been rated critical or high severity. Anthropic explicitly says this is likely an undercount: the figures rest on partial data from 33 partner reports, and fewer than half of partners disclosed patched numbers, often because fixes were still in progress, so the patch rate is significantly undercounted. On that basis Anthropic expects the true impact to be at least five times higher. On data retention, organizations enrolled in the program must retain data so Anthropic can monitor for cyber misuse; once Enterprise Frontier Safeguards (EFS) becomes available later this fall, eligible organizations will be able to store data in cloud infrastructure they control.

On channels and boundaries, Anthropic says CVP is available on the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry; on Amazon Bedrock it is only available to customers eligible for Enterprise Frontier Safeguards. Existing CVP members keep their current settings for previous models and are automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 through the updated program. Anthropic also reiterates that generally available models can still be used for tasks such as code review, patching known issues, finding vulnerabilities in owned source code and triaging security alerts. If work your tier should allow is blocked, the company provides a false-positive reporting form. This article presents only facts stated in the official announcement, with no speculation about where the tiered system goes next.