Anthropic Splits Its Cyber Verification Program Into Three Tiers and Absorbs Project Glasswing

Anthropic on October 6, 2026 relaunched its Cyber Verification Program as three access tiers that give vetted security teams fewer cyber blocks on its most capable Claude models. The company also folded Project Glasswing, its invitation only program for Claude Mythos, into the new structure.

The change merges two programs that ran side by side for about six months and opens advanced cyber capabilities to a wider group of defenders, Anthropic said in its announcement. It sits at the center of the policy and safety debate over dual use AI: the same model that helps a team find and fix a flaw can help an attacker exploit it.

What did Anthropic change in the Cyber Verification Program?

Anthropic replaced the single level of the Cyber Verification Program with three tiers on October 6, 2026, each tied to the scope of a team's security work and to stricter verification and security controls.

The program exists because Anthropic's generally available models ship with conservative cyber safeguards: classifiers, automated filters that scan requests and outputs in real time, which Anthropic says block most cyber work beyond everyday secure coding.

Anthropic announced Project Glasswing, its program that gave organizations securing critical software access to Claude Mythos, on April 7, 2026 with launch partners such as Apple, CrowdStrike and Microsoft. Its members now move to the top tier without reapproval for current models.

Who qualifies for each tier?

Defense Access is the broad entry tier, Red Team Access adds offensive testing for organizations only, and Specialized Access is reserved for a limited set of organizations that test systems such as power grids and flight operating systems. Anthropic says it reviews every Specialized Access applicant in depth in collaboration with the US government.

That role for Washington comes amid a fight between Anthropic and the administration. On February 27, 2026, President Trump ordered all federal agencies to phase out Anthropic technology after the company refused the Pentagon's demand to drop safeguards against mass surveillance and fully autonomous weapons (ABC7 News). A Pentagon official told the BBC on October 5, 2026 that the department "has ceased the use of Anthropic products", and Anthropic is suing over the supply chain risk label the Pentagon gave it (BBC). Anthropic's Help Center says it keeps working with the US government to expand the number of eligible organizations, both in the US and abroad.

The Claude Help Center sets a general target: Anthropic aims to email a review decision or a request for more information within seven business days of an application.

Penetration testing, or pen testing, means attacking a system with the owner's permission to find weak spots. Anthropic says Red Team Access users can only test systems they are authorized to test and still face real time blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware.

All enrolled organizations must allow data retention so Anthropic can monitor for cyber misuse. The company says a new option called Enterprise Frontier Safeguards, which pairs zero data retention with safeguards, will let eligible organizations keep data in cloud infrastructure they control once it launches later this fall.

How does Anthropic say the tier safeguards perform?

Anthropic says its tests on Claude Opus 5.5 show the tiers behave as designed: the generally available model blocked every task in an offensive cyber evaluation, Defense Access blocked 46 of 50 trials, and Red Team Access blocked none. These are the company's own results.

The test, CyScenarioBench, checks whether a model can plan and carry out multi stage cyber operations, with five attempts on each of 10 challenges per tier. In Red Team Access, Claude Opus 5.5 completed 34 of the 50 tasks, which Anthropic calls effectively equivalent to the 67.6% success rate the model reaches with no safeguards, the setting it says represents Specialized Access.

What did Project Glasswing find?

Anthropic says Project Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, and that its own scanning of open source code found about 5,500 more between April and October 2026. The figures come from a survey of 33 partners and Anthropic's own work, and have not been independently verified.

Anthropic says more than 33,000 of these verified vulnerabilities were rated critical or high severity. It calls the numbers a lower bound because only a subset of partners reported and fewer than half disclosed patch counts, and it expects the true impact to be at least five times higher.

Partner accounts from Booz Allen and Comcast are on the Claude blog.

Mistral AI argued for the opposite route on the same day: it says closed models refuse legitimate vulnerability research, and it plans to give defenders open weights for Mistral Large 4 after red teaming them with partners and governments. Anthropic's Frontier Red Team lead also testified on AI risks at the New York City Council hearing on October 5, 2026.

What we don't know yet

• How many organizations or individuals Anthropic expects to admit to each tier, and how many have applied.
• How the US government's review of Specialized Access applicants works in practice, given the administration's dispute with Anthropic.
• When Enterprise Frontier Safeguards will launch and in which regions.
• Whether pricing differs between tiers; the announcement does not mention cost.
• Whether an outside party will test the tier safeguards beyond Anthropic's own CyScenarioBench results.