Enhanced Cyber Verification Program Expands AI Access for Security Teams

Anthropic is evolving its Cyber Verification Program (CVP) to broaden the availability of advanced cyber capabilities for vetted security teams, loosening restrictions on some of its most sophisticated AI models. This move aims to equip defenders with powerful tools essential for securing their systems.

The expanded program introduces three distinct access tiers, tailored to the specific cybersecurity roles organizations fulfill. These tiers encompass defensive security operations, authorized red teaming, and systemic testing for environments that impact public safety or financial markets.

“Defenders also need access to the best tools and most powerful capabilities to secure their systems,” Anthropic stated in its recent announcement.

Currently, Anthropic's publicly accessible models feature conservative safeguards intended to thwart most cyber threats. The company asserts these measures aim to mitigate harmful activities while also addressing concerns over excessive false positives that hinder secure coding practices.

Understanding the Tier Structure

The expanded Cyber Verification Program integrates elements from two key initiatives that Anthropic has championed over the preceding six months: Project Glasswing and the existing CVP. Project Glasswing provided select organizations managing critical software with access to Claude Mythos. Meanwhile, the current CVP allowed approved security teams to leverage Claude Opus and Claude Sonnet models but with more stringent safeguards.

“The enhancements we’re making to our Cyber Verification Program today are designed to scale the benefits of Project Glasswing for a wider array of cybersecurity defenders,” the announcement noted.

Existing participants in Glasswing will transition to the Specialized Access tier without needing to gain approval for their existing AI models again. The Defense Access tier focuses on defensive tasks, including security operations, incident response, malware analysis, and vulnerability validation.

The Red Team Access tier involves authorized penetration testing and red teaming operations, with users permitted to test only those systems for which they hold authorization. Lastly, the Specialized Access tier, which carries the fewest restrictions, is meticulously reserved for a limited group of verified organizations. These entities are permitted to evaluate critical systems such as aviation operational systems, power grids, telecommunications infrastructures, interbank transfer networks, and government systems.

To establish credibility for organizations seeking Specialized Access, Anthropic collaborates with the U.S. government during the review process.

Benchmarking Access Levels through Testing

The efficiency of the various access levels was scrutinized using CyScenarioBench, crafted to assess the AI models' proficiency in planning and executing multistage cyber operations.

In these evaluations, Claude Opus 5.5 was subjected to ten specific challenges, with five trials allocated per access tier. For those lacking CVP access, all 50 attempts failed at the initial prompt. With Defense Access, 46 trials were inhibited at some stage, resulting in only four successes. Conversely, utilizing Red Team Access resulted in no trials being blocked, leading to 34 completions—an achievement corresponding to a 67.6% success rate without any safeguards.

Sakshi Grover, research director at IDC, emphasized the importance of contextualizing these results since the evaluation was conducted by Anthropic and not a third-party organization. She noted that the outcomes highlight the significance of authorization and scope in the application of AI for security assessments.

“Legitimacy derives from authorization, target scope, and execution conditions, not solely from the methodology employed,” Grover explained.

Deepika Giri, IDC's vice president of Asia/Pacific Artificial Intelligence Platforms and Advisory, recommended continuous review of access tiers as a prerequisite for effective deployment.

Ensuring Control Beyond Safeguards

Grover contended that organizations should implement controls external to the AI model when granting reduced safeguards or privileged access. “When model-level refusals dwindle, external controls become imperative,” she emphasized.

Her suggestions include assigning distinct identities to each AI agent, tying short-term privileges to specific tasks, performing independent verifications of targets and actions, and regularly testing containment and recovery protocols.

Giri echoed this sentiment, advising that entities should regard an AI agent as a privileged employee, fitting it with an identity, enforcing time-restricted access for particular tasks, and maintaining full observability and control over actions performed. Human oversight is encouraged, especially for high-stakes decisions.

Addressing accountability, cybersecurity researcher and red team expert Vibhum Dubey emphasized that organizations must delineate responsibility for actions taken by autonomous systems.

“Determining accountability for the actions executed by AI systems is essential,” Dubey remarked.

According to Anthropic, partners involved in Project Glasswing identified over 129,000 validated software vulnerabilities between April and July 2026. In parallel, its open-source scanning initiatives also detected an additional 5,500 vulnerabilities from April to October of the same year.

Of the identified vulnerabilities, over 33,000 have so far been classified as critical or of high severity. Anthropic anticipates that this figure may be conservative, estimating the true count could be significantly higher, potentially five times greater based on feedback from a limited subset of Glasswing participants.

Organizations participating in CVP will be subjected to data retention policies, enabling Anthropic to supervise potential misuse of its cybersecurity tools. The company is also set to launch its upcoming Enterprise Frontier Safeguards service, which affords qualified organizations the ability to amalgamate zero-data-retention features with supplementary safeguards, all while retaining control of their cloud-stored data.