Anthropic expands cyber access through three‑tier verification program

On October 6, 2026 Anthropic released an expanded Cyber Verification Program (CVP) that consolidates the former CVP and Project Glasswing into a single framework. The company says the new structure offers three verification tiers—Defense Access, Red Team Access, and Specialized Access—while keeping the same core models, Opus 5.5, Sonnet 5.5 and Mythos 5.1, available to all participants. The announcement was posted on Anthropic’s official news site and covered the following day by SecurityWeek, highlighting the program’s aim to give vetted users deeper AI capabilities for cybersecurity work without compromising Anthropic’s broader safety commitments.

Three tiers, one unified program

The merged program replaces the separate verification tracks that previously existed under the CVP label and the experimental Project Glasswing initiative. By unifying the two, Anthropic intends to streamline onboarding, reduce administrative friction, and provide a clearer set of expectations for each level of access. All three tiers share the same foundational models—Opus 5.5, Sonnet 5.5 and Mythos 5.1—ensuring that every participant works with the latest generation of Anthropic’s language models while the verification tier determines the extent of real‑time safety blocks applied during use.

Defense Access: enabling security operations

Defense Access is the middle tier and is aimed at organizations and individuals that conduct security‑operations‑center (SOC) work, incident response, malware reverse‑engineering and vulnerability analysis. Anthropic states that the tier can be granted to companies, public bodies, software maintainers and independent researchers who have demonstrated a legitimate need for advanced AI assistance in defensive cybersecurity tasks. While the tier still enforces real‑time blocks on content that could facilitate ransomware, physical harm or mass disruption, it relaxes some of the stricter safeguards applied to the general public model, allowing users to explore more detailed technical queries that support defensive investigations.

Red Team Access: authorized penetration testing

Red Team Access builds on Defense Access by adding permission for authorized penetration testing against client systems. Participants in this tier may use Anthropic’s models to generate attack‑simulation scripts, probe network configurations and test exploit pathways, provided the engagements are pre‑approved and documented. The tier retains the same real‑time block list that prevents the generation of instructions for ransomware, physical harm and mass disruption, ensuring that even offensive testing stays within a controlled safety envelope. Anthropic’s public benchmarks show that the Red Team tier experienced no blocks on the CyScenarioBench suite and successfully completed 34 of 50 trials, a performance close to the 67.6 % unsafeguarded rate observed in unrestricted testing.

Specialized Access: testing safety‑critical infrastructure

Specialized Access is the most permissive tier and is limited to a small set of deeply vetted organizations that need to test AI‑driven safety controls on critical systems such as power grids, aviation networks, telecommunications infrastructure and interbank transfer platforms. Access to this tier is reviewed in coordination with the United States government, reflecting the high‑stakes nature of the work. The tier applies the fewest real‑time blocks, allowing participants to explore edge‑case scenarios that would be blocked in the other tiers, while still prohibiting content that could cause ransomware, physical harm or mass disruption. This selective openness is intended to support rigorous safety research on systems where AI failures could have widespread societal impact.

Across all three tiers, Anthropic includes the same suite of models—Opus 5.5, Sonnet 5.5 and Mythos 5.1—so that users benefit from the latest advances in language understanding, reasoning and code generation. The company emphasizes that the tiered approach does not create separate model versions; instead, the verification status determines which safety filters are active at runtime. This design choice simplifies model maintenance while still providing differentiated risk profiles for users with varying security needs.

Anthropic’s internal testing on the CyScenarioBench benchmark provides early evidence of how the tiers differ in practice. The baseline public model blocked all 50 trials at the first prompt, demonstrating a highly conservative safety posture. Defense Access reduced the block count to 46 of 50, indicating that many defensive queries can pass the filters while still protecting against high‑risk content. Red Team Access recorded zero blocks and completed 34 of 50 trials, aligning closely with the unsafeguarded benchmark rate of 67.6 %. Specialized Access, while not explicitly quantified in the brief, is described as having the fewest blocks, reflecting its purpose for tightly controlled safety‑critical testing.

Data retention policies remain a core component of the program. Anthropic states that standard usage data is retained for operational purposes, but a controlled zero‑retention option is being planned for future rollout. This option would allow verified users to request that their interaction logs be deleted immediately after processing, further reducing the risk of sensitive security information being stored long‑term. The company has not provided a specific timeline for the zero‑retention feature, but its inclusion signals an awareness of the confidentiality concerns that accompany advanced cybersecurity work.

The launch of the three‑tier Cyber Verification Program changes the landscape for organizations that rely on AI to augment their security capabilities. By offering a graduated set of safeguards, Anthropic enables defensive teams, authorized red‑team operators and critical‑infrastructure researchers to access powerful language models while maintaining a clear boundary against malicious misuse. The program’s public rollout means that eligible entities can now apply for the appropriate tier, integrate Opus 5.5, Sonnet 5.5 or Mythos 5.1 into their workflows, and benefit from the reduced block rates demonstrated in Anthropic’s benchmark results. As the zero‑retention option matures, participants will also gain greater control over the privacy of their security‑related data.