Anthropic Expands Cyber Verification Program With 3-Tier Access

Anthropic has announced a significant expansion of its Cyber Verification Program (CVP), consolidating two previously separate restricted-access initiatives into a single, three-tiered framework that for the first time explicitly names universities and individual security researchers as eligible applicants. The move gives qualifying professionals access to frontier-grade Claude models — including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 — with reduced safety restrictions that are otherwise applied to all standard users.

The backstory matters here. Anthropic’s generally available Claude models carry conservative cybersecurity safeguards that block most offensive security work, by design. The dual-use nature of cybersecurity — where the same technique that finds a vulnerability can also exploit one — makes that a reasonable default. But it also means legitimate defenders have been operating with one hand tied behind their back. The expanded CVP is Anthropic’s structured answer to that tension.

How the Three Tiers Work

The new program replaces both the original CVP and Project Glasswing, a six-month pilot that gave a select group of organizations access to Claude Mythos for critical infrastructure security work. The three tiers are calibrated to the verified scope of a user’s work.

Defense Access is the entry-level tier, designed for defensive tasks like incident response, malware reverse-engineering and vulnerability analysis. Qualifying groups include security teams at companies, nonprofits, universities and government bodies, as well as operators of critical infrastructure, open-source maintainers and individual researchers with a documented track record of reported vulnerabilities. Anthropic says it aims to respond to applications within a few days.

Red Team Access adds authorized penetration testing and red-teaming on top of everything Defense Access covers. In-house red teams, government red teams and security testing firms are the target audience. Users in this tier still face real-time blocks on catastrophic actions — deploying ransomware, damaging physical systems or pen-testing high-risk safety infrastructure. Applications here take a few weeks to review, and individual researchers are not currently eligible.

Specialized Access is the most restricted tier, reserved for organizations authorized to test safety-critical systems like flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. Enrollment currently requires review in collaboration with the U.S. government. Organizations that were already part of Project Glasswing automatically transition here and do not need to reapply.

The Numbers Behind the Decision

Anthropic released benchmark results to justify the tier structure. Running Claude Opus 5.5 through CyScenarioBench — an evaluation that simulates multi-stage, realistic cyber operations — the company found that without CVP access, every single task was blocked on the first prompt. In the Defense Access tier, 46 of 50 trials were blocked at some point. In the Red Team Access tier, no blocks occurred and Claude Opus 5.5 completed 34 of 50 tasks — a 68% success rate effectively matching its unguarded baseline of 67.6%.

The real-world data from Project Glasswing is harder to ignore. Between April and July 2026, partner organizations using Claude Mythos uncovered at least 129,000 verified software vulnerabilities. Anthropic’s own open-source scanning added another 5,500 between April and Oct. 2026. More than 33,000 of the combined total have been rated critical- or high-severity. Anthropic notes this is almost certainly an undercount, drawn from survey data covering only a subset of Glasswing partners, and estimates the true figure could be at least five times higher.

A Competitive Landscape That’s Moving Fast

Anthropic is not operating in a vacuum. Since roughly April 2026, when Project Glasswing launched, OpenAI and Google have both introduced their own tiered cybersecurity access programs. OpenAI’s Daybreak Cyber Partner Program and Google’s Fairwind Program — which pairs Gemini 3.8 Flash Cyber with a vulnerability remediation agent called CodeMender — follow the same basic governance model: vet applicants, layer access by risk level, monitor for misuse.

The meaningful difference is in who gets in the door at the ground level. Google’s Fairwind Program initially prioritizes government agencies, Google Cloud customers and professional security partners; students are directed to a separate, more restricted product. Anthropic’s CVP Defense tier, by contrast, explicitly names universities and individual researchers with bug bounty experience as qualifying groups. That’s a meaningfully wider opening for people who are still in school or early in their careers.

What This Means If You’re a Student or Early-Career Researcher

If you’re a college student actively participating in bug bounty programs, running a university security research group, or maintaining open-source software with a security component, you may qualify for Defense Access today. That means access to Claude Opus 5.5 and Claude Mythos 5.1 for legitimate defensive tasks — malware analysis, vulnerability triage, incident response work — without the heavy-handed blocks that apply to standard Claude users.

Beyond the immediate research utility, there’s a career signal worth paying attention to. The Glasswing data showing that partners found vulnerabilities months or even years faster than they would have otherwise suggests that AI-assisted security workflows are quickly becoming a baseline expectation in the industry, not a novelty. Employers hiring security analysts and penetration testers in the coming years will increasingly assume fluency with these tools. Getting hands-on experience now — especially through a program that requires documented, verified work — is a way to build a portfolio that stands out.

Data retention is currently required for all CVP participants so Anthropic can monitor for misuse. A new privacy-preserving solution called Enterprise Frontier Safeguards is expected later this fall and will allow eligible organizations to store data in infrastructure they control. The CVP is available through the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry.

Organizations and qualifying individuals can apply directly through Anthropic’s CVP portal.

Source: Anthropic