Anthropic Expands Cyber Verification Program into Three-Tiered Access Model

Anthropic Expands Cyber Verification Program into Three-Tiered Access Model Anthropic has launched an expanded Cyber Verification Program (CVP) by merging it with Project Glasswing, offering qualified security professionals reduced cyber-safeguard blocking across three distinct access tiers on models such as Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1. CVP is now structured into three tiers—Defense Access, Red Team Access, and Specialized Access—catering to varying levels of defensive and offensive security operations. Specialized Access carries the fewest cyber blocks, is reviewed in collaboration with the US government, and is reserved for testing high-risk systems such as power grids and flight operations. Data retention is mandated for CVP misuse monitoring until Enterprise Frontier Safeguards (EFS) launches later in the fall to support zero-data-retention environments. Partners participating in the preceding Project Glasswing uncovered at least 129,000 verified software vulnerabilities between April and July 2026. Program Structure and Tiers The revamped CVP consolidates Project Glasswing and previous CVP offerings to balance dual-use security concerns with defender access. It introduces Defense Access for incident response, malware reverse-engineering, and vulnerability validation; Red Team Access for authorized adversarial and penetration testing; and Specialized Access for critical safety systems affecting lives or markets, vetted alongside the US government. Data Governance and Benchmarking Enrolled organizations must maintain data retention for monitoring purposes until the launch of Enterprise Frontier Safeguards (EFS), which will allow qualifying clients to retain zero-retention controls in their own cloud infrastructure. To evaluate tier safeguards, Anthropic tested Claude Opus 5.5 on CyScenarioBench across interactive offensive scenarios, verifying that safeguard tuning accurately distinguishes between general, defensive, and red-team operations. Defensive Impact and Availability Between April and July 2026, Project Glasswing partners discovered over 129,000 verified software vulnerabilities using Claude Mythos models, with more than 33,000 designated high or critical severity. CVP is available across the Claude Platform, Google Cloud Vertex AI, Microsoft Foundry, and on Amazon Bedrock for EFS-eligible customers, while existing members are automatically evaluated for the new model tiers.

Anthropic升级网络验证计划：设三级权限开放前沿网络安全能力 Anthropic宣布推出升级版网络验证计划（CVP），整合原有CVP与Project Glasswing，为通过审核的安全专业人员和机构提供三级访问权限，在降低拦截分类器限制的同时开放Claude Opus 5.5和Claude Mythos 5.1等前沿模型的网络安全能力。 计划分为防御访问、红队访问和专业访问三个层级，依据工作范畴实施差异化审核和拦截策略。 为防范滥用，计划要求数据留存监控，秋季推出结合零数据留存与防护的EFS方案后支持自主云存储。 此前Project Glasswing合作伙伴与自主扫描累计发现逾13.4万个已验证软件漏洞，其中超3.3万个为高危或严重级别。 该计划已在Claude Platform、Google Cloud Vertex AI及Microsoft Foundry上线，Amazon Bedrock仅向符合EFS条件的客户开放。 三级访问权限划分 针对网络安全的双重用途特性，升级后的CVP设立了三个层级：防御访问（Defense Access）面向SOC、事件响应、恶意软件逆向与漏洞分析等防御任务，向企业、高校、关键基础设施及独立研究员开放；红队访问（Red Team Access）增加经授权的渗透测试与红队对抗，仅限机构申请，并持续拦截可能导致物理破坏或大规模中断的行动；专业访问（Specialized Access）拦截最少，与美国政府合作深度审查，仅限获准测试电网、电信、航空等生命与市场关键安全系统的机构。 安全控制与数据合规 参与CVP的组织须遵守数据留存要求以监测滥用。Anthropic计划于秋季晚些时候推出企业前沿防护（EFS），允许合规机构在自主控制的云架构中存储数据并实现零数据留存。目前，拥有Claude Fable 5.1或Mythos 5.1零留存权限的机构可在CVP中维持该配置。此外，模型在CyScenarioBench的攻防基准测试中验证了不同层级安全拦截策略的有效性。 前期成果与平台支持 在整合前的Project Glasswing项目中，Claude Mythos模型帮助合作伙伴在2026年4月至7月间发现了至少12.9万个已验证漏洞，内部开源扫描另发现5500个，其中严重和高危漏洞超3.3万个。目前CVP已在Claude Platform、Google Cloud Vertex AI和Microsoft Foundry推出，原Glasswing成员将直接过渡至专业访问层级。

We’re launching a new, expanded version of our Cyber Verification Program (CVP), which makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals. The program now consists of three access tiers, which allow security teams to apply for the level of access that best suits their work. Each tier includes access to our most capable models, including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and new models moving forward. Interested customers can [apply here](https://portal.anthropic.com/programs/cvp). Cybersecurity is inherently dual use: the same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it. For this reason, our generally available models, such as [Claude Opus 5.5](https://www.anthropic.com/claude-opus-5-5), [Claude Fable 5.1](https://www.anthropic.com/claude-fable-and-mythos-5-1), and [Claude Sonnet 5.5](https://www.anthropic.com/claude-sonnet-5-5), have conservative cyber safeguards that block most cyber work. This is intended to limit the harmful activities malicious actors can carry out using our models, while we continue to work to reduce false positives for secure coding. But defenders also need access to the best tools and most powerful capabilities to secure their systems. For the past six months, we’ve enabled trusted access through two programs: [Project Glasswing](https://www.anthropic.com/glasswing) and the [CVP](https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude-opus-and-sonnet). The former gave a group of organizations securing the most critical software access to Claude Mythos; the latter gave vetted security teams access to reduced safeguards on Claude Opus and Claude Sonnet models. Now, we’re integrating these programs into one expanded offering, designed to give more security organizations access to the capabilities they need to protect their systems. The updated access tiers make specific model capabilities available to security professionals based on the scope of their cyber work. Each has different verification requirements and security controls. **Defense Access** is for defensive work, including security operations center and incident response tasks, reverse-engineering malware, and analyzing and validating vulnerabilities. Examples of qualifying organizations include security teams at companies, nonprofits, universities, and government bodies who are defending systems they own or maintain; operators of critical infrastructure of any size, such as regional hospitals or municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a track record of reported vulnerabilities. We expect many organizations conducting defensive cybersecurity work to qualify for this tier. We aim to respond to applications within a few days. **Red Team Access** adds authorized penetration testing and red-teaming to the defensive uses above. Examples of qualifying organizations include in-house red teams, government red teams, and security and penetration testing firms. Organizations in this tier can only perform adversarial testing against systems they are authorized to test, including IT systems in critical industries. Users will still experience real-time blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or pen testing high-risk safety systems. Given the increased eligibility requirements and security controls, we expect applications in this tier to take a few weeks to review. Qualifying organizations will be enrolled in the Defense Access tier while we review their Red Team Access applications. Currently, this tier is for organizations only; individual researchers are not eligible. **Specialized Access**, which has the fewest cyber blocks, is reserved for a limited set of verified organizations that are authorized to test safety systems that could impact people’s lives or disrupt markets, such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks. For this tier, we currently review every organization in depth in collaboration with the US government. Existing members of Project Glasswing will transition to this tier and do not require reapproval for current models. Our generally available models can continue to be used for tasks such as code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts. Data retention is required for organizations enrolled in the program so that we can monitor for cyber misuse. Once [Enterprise Frontier Safeguards](https://www.anthropic.com/news/enterprise-frontier-safeguards) (EFS)—a new solution that combines the privacy of zero data retention with robust safeguards—is available later this fall, eligible organizations will be able to store data in cloud infrastructure they control. Until EFS is available, organizations with access to Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can also use CVP with zero data retention. To register interest in EFS, [fill out this form](https://claude.com/form/enterprise-frontier-safeguards). Below, we share an overview of what’s available at each CVP access level, as well as requirements for security and privacy controls: To assess the efficacy of our CVP protections, we ran Claude Opus 5.5 through CyScenarioBench—an evaluation that measures whether models can plan and execute multi-stage cyber operations under realistic constraints—with safeguards tuned for our different CVP tiers. Because this evaluation involves complex, interactive offensive scenarios, we would expect Claude to experience significant blocks both on the generally available model and in the Defense Access tier, while experiencing no blocks in the Red Team Access and Specialized Access tiers. Across five attempts at each of the 10 CyScenarioBench challenges in each access tier, we found that: These evaluations give us confidence that we can make advanced cyber capabilities safely available to a broader set of defenders, expanding the defensive efforts we began with Project Glasswing. We will continue to refine our tier-based classifiers over time. Through Project Glasswing, we found that Claude Mythos models significantly increased the rate at which organizations were able to identify vulnerabilities in their systems. Through the program, our partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026. And through our own open-source scanning efforts, we found an additional 5,500 verified software vulnerabilities between April and October 2026. Of these verified vulnerabilities, more than 33,000 have so far been rated as critical- or high-severity. This is likely an undercount, as it is based on survey data from only a subset of Glasswing partners. As such, we expect the true impact to be at least five times higher. When asked how long it would have taken them to find the same number of vulnerabilities without Claude Mythos models, several partners told us that the models had increased their rate of vulnerability finding by months or even years. Read more from our partners at [Booz Allen and Comcast](https://claude.com/blog/how-comcast-booz-allen-use-claude-mythos-to-secure-their-codebases) about their experience. The changes we’re making to our Cyber Verification Program today are intended to extend the impact of Project Glasswing to a much larger number of cyber defenders. We’re also continuing our efforts to help secure open-source software and critical infrastructure. In the coming weeks, we’ll share more about this work and what we’ve learned as we continue to work to give defenders a permanent advantage. Interested organizations can [apply to CVP here](https://portal.anthropic.com/programs/cvp). As part of the application process, we will verify all applicants and request proof of the required security controls for the relevant access tier. Existing CVP members will keep their current settings for previous models and will be automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 through the updated program. Admins will need to assign access to specific workspaces by following [these steps](https://support.claude.com/en/articles/16764810-assign-a-program-to-workspaces-in-claude-console). CVP is available on the Claude Platform, Google Cloud’s Vertex AI, and Microsoft Foundry. CVP is only available on Amazon Bedrock for customers eligible for [Enterprise Frontier Safeguards](https://www.anthropic.com/news/enterprise-frontier-safeguards). If you’re blocked on work you think your tier should allow, you can [report it here](https://claude.com/form/cyber-block-false-positive-report-cvp-rejection-appeal). Full details on each tier can be found in our [Help Center](https://support.claude.com/en/articles/14604842-real-time-cyber-safeguards-on-claude-opus-and-sonnet).