Anthropic's Cyber Verification Program Now Has Three Tiers: What Defense, Red Team and Specialized Access Change for Security Teams
- On October 6, 2026, Anthropic expanded the Cyber Verification Program (CVP) into three access tiers and merged Project Glasswing into it. Every tier includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, and applications go through Anthropic's developer portal.
- Defense Access covers work on systems you own or maintain (SOC and incident response, malware reverse-engineering, vulnerability analysis and validation) and is open to company security teams, critical infrastructure operators of any size, open-source maintainers and researchers with a track record; Anthropic aims to answer in a few days. Red Team Access adds authorized penetration testing and takes a few weeks to review. Specialized Access, with the fewest blocks, is reserved for organizations testing safety systems that could affect lives or markets, each reviewed with the US government; existing Glasswing members move there.
- Anthropic published its own numbers: on a 50-trial multi-stage cyber benchmark, a generally available model was blocked on every task, Defense Access was blocked at some point in 46 of 50, and Red Team Access completed 34 of 50 with no blocks, matching the model's unsafeguarded rate. Glasswing partners reported at least 129,000 verified vulnerabilities between April and July, with Anthropic's own open-source scanning adding 5,500 by October.
- Enrolled organizations must retain data so Anthropic can monitor for misuse. Enterprise Frontier Safeguards, which keeps that data in infrastructure the customer controls, is expected later this fall; until then only organizations already holding Fable 5.1 or Mythos 5.1 under zero data retention can combine it with CVP.
- Two days later, on October 8, Anthropic launched the Cyber Mission: a Critical Infrastructure Defense Program with eleven founding partners, and OSS Scanner, a free opt-in service that sends open-source maintainers model-generated vulnerability reports without human review, with a proof of concept and suggested fix.
- A tier is a permission one organization holds with one provider. It says nothing about which laptops hold that access, which accounts employees actually sign in with, or what the agents on those machines do with the capability. That layer is still yours to govern.
In one week Anthropic restructured how security teams get cyber capability out of its models and said what it intends to do with that capability itself. On October 6, 2026, the Cyber Verification Program became a three-tier scheme and absorbed Project Glasswing. On October 8 the company launched the Anthropic Cyber Mission, with a critical-infrastructure program and a free vulnerability scanner for open-source projects. We are a verified organization in the program and have been since June, so this is partly a note about what changed for us. Mostly it is about what the tiers mean for the teams that will apply, and about the governance question the tiers do not answer.
The three tiers
| Tier | What it covers | Who it is for | Review time |
|---|---|---|---|
| Defense Access | SOC and incident response, malware reverse-engineering, vulnerability analysis and validation on systems you own or maintain | Company, nonprofit, university and government security teams; critical infrastructure operators of any size; smaller security firms; open-source maintainers; researchers with a disclosure track record | A few days |
| Red Team Access | Defense Access plus authorized penetration testing and red-teaming against systems you are permitted to test | In-house, government and commercial red teams. Not individual researchers | A few weeks, with Defense Access granted meanwhile |
| Specialized Access | The fewest cyber blocks; testing safety systems that could affect lives or markets (flight systems, grids, telecom, interbank transfer, government networks) | A limited set of verified organizations, each reviewed in depth with the US government. Existing Glasswing members move here | In-depth review |
Every tier includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models. The generally available models keep conservative safeguards that, in Anthropic's description, block most cyber work while leaving code review, patching known issues, finding vulnerabilities in your own source and triaging alerts available to everyone. Even in Red Team Access, actions that could cause physical harm or mass disruption stay blocked in real time; ransomware deployment and damaging physical systems are the examples given. The program is available on the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry; on Amazon Bedrock only to customers eligible for Enterprise Frontier Safeguards.
What the tiers do to the model, in Anthropic's own numbers
The announcement includes a benchmark that is more useful than the tier descriptions. Anthropic ran Claude Opus 5.5 on ten multi-stage cyber challenges, five attempts each, fifty trials per tier:
- No CVP access: every task blocked on the first prompt.
- Defense Access: blocked at some point in 46 of 50 trials; 4 succeeded.
- Red Team Access: no blocks; 34 of 50 tasks completed, which equals the model's 67.6 percent success rate with no safeguards at all. Anthropic says that is representative of Specialized Access too.
Read plainly: Defense Access is a narrow lift, enough to stop a reverse-engineering session being refused halfway, and not a way to run an operation. Red Team Access is, for in-scope work, the unsafeguarded model. That is the honest version of the distinction we drew in June between dual-use work that verification can unblock and prohibited work that it cannot, and it has the same shape as the fallback behaviour we described in the Fable 5.1 and Mythos 5.1 post, where a flagged request drops to a different model rather than being refused outright. The program also publishes what Glasswing produced: at least 129,000 verified vulnerabilities reported by partners between April and July 2026, 5,500 more from Anthropic's own open-source scanning by October, more than 33,000 rated critical or high, from partial data covering fewer than half the partners' patch counts.
The data-retention condition
One line in the announcement will decide whether some enterprises can use the program at all. Enrolled organizations must retain data so Anthropic can monitor for cyber misuse. Zero-data-retention customers were ineligible for the original program for the same reason, and the expanded one keeps the condition, with one bridge: organizations already holding Claude Fable 5.1 or Claude Mythos 5.1 under zero data retention can use CVP that way until Enterprise Frontier Safeguards ships, which Anthropic now expects later this fall. We described EFS when it was announced: the monitoring data stays in cloud infrastructure the customer controls. For a regulated security team, the order of operations is EFS first, then the tier.
The Cyber Mission, and a scanner with no human in the loop
The October 8 announcement is a statement of intent with two concrete programs. The Critical Infrastructure Defense Program brings frontier models, on-site engineers and threat research to providers defending operational technology, starting with a small cohort of eleven founding partners: Accenture, Booz Allen, CrowdStrike, Deloitte, Dragos, Hitachi, Insane Cyber, Nozomi Networks, Palo Alto Networks, PwC and Rockwell Automation. Anthropic also says that since its June program for state and local governments it has offered models and support to more than half of US states.
OSS Scanner is the more interesting one for anyone who maintains software. Enrolled open-source projects get periodic scans from Anthropic's most capable models, free, each report carrying a proof of concept, an explanation and, where available, a suggested fix. Anthropic is candid about the trade: the reports are model-generated and sent without human review, so some will be wrong, including on severity, and the service is limited to projects that can keep up. It expects a true-positive rate above 90 percent. It also says the quiet part about Glasswing: finding 129,000 vulnerabilities did not reduce risk as much as hoped because months often passed between discovery and fix, which is why the mission's next goals are automated triage and patching. This is the dynamic we described when OpenAI reported Astra's cyber capability and when Anthropic's own evaluations escaped their sandboxes: finding is now cheap, and the bottleneck has moved to everything after it.
What a tier does not govern
A tier is a permission one organization holds with one provider, assigned by an administrator to specific workspaces. Three things sit outside it. First, which machines hold the access. An engineer with a Red Team workspace and a coding agent on a laptop has an unsafeguarded model wired into a tool that reads repositories and runs commands; that agent, its MCP servers and its hooks are governed by nothing in the program. Second, which account is actually in use. The tier applies to the verified organization's workspace; a personal Claude account in a browser tab on the same machine is a generally available model with conservative safeguards and no monitoring, and the difference is invisible unless something is looking at the sign-in. Third, the rest of the toolchain. Verification moves a boundary for one vendor's models; it says nothing about the local model runtimes, the other vendors' agents, or the security agents that are agents too already on the endpoints.
How Anomity surfaces and governs it
See it. The Anomity Endpoint Sensor inventories the agents, CLIs, MCP servers, extensions, skills, hooks and local LLM runtimes on every managed machine, so the laptops where a verified workspace meets a coding agent are a list rather than a guess. The Browser Sensor sees which AI web services are in use and whether the signed-in account is corporate or personal, which is the difference between a monitored tier and an unmonitored model on the same machine. Cloud discovery covers the Google Workspace and GitHub OAuth grants held by AI applications. Metadata only; secrets are redacted on the endpoint.
Enforce before the call runs. On agents that expose a pre-execution hook, such as Claude Code PreToolUse, Anomity decides allow, deny or log before a tool call runs, which is the control that matters when the model behind the agent has fewer refusals. Keep the record. Decisions and inventory changes land in a 90-day audit trail and route to SIEM, Slack, email or Jira. Anomity is SOC 2 Type II and complements EDR, DLP, network and GRC tooling; it does not replace them.
The tiers are a good design, and the benchmark is the most honest thing a model provider has published about what its safeguards do. They govern what your organization may ask one provider's models. If you want to see what the agents holding that access are doing on your own endpoints, book a 30-minute demo.
Frequently asked questions
What changed on October 6?
The Cyber Verification Program went from a single verification to three tiers, and Project Glasswing, which had given organizations securing critical software access to Claude Mythos, was merged into it. Each tier gives access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models with reduced cyber blocking. Existing CVP members keep their current settings for earlier models and are automatically evaluated for the new ones; existing Glasswing members move to Specialized Access without reapproval. Applications are made through Anthropic's developer portal, and administrators then assign the access to specific workspaces.
What does each tier allow?
Defense Access covers defensive work on systems the organization owns or maintains: security operations and incident response, malware reverse-engineering, vulnerability analysis and validation. Red Team Access adds authorized penetration testing and red-teaming against systems the organization is permitted to test, and is open to in-house, government and commercial red teams but not individual researchers; applicants are placed in Defense Access while the review runs. Specialized Access has the fewest blocks and is reserved for a limited set of organizations authorized to test safety-critical systems such as flight operating systems, power grids, telecom networks and interbank transfer infrastructure, each reviewed in depth with the US government.
What stays blocked at every tier?
Anthropic says Red Team Access users still see real-time blocks on actions that could cause physical harm or mass disruption, and gives deploying ransomware, damaging physical systems and penetration testing high-risk safety systems as examples. It does not publish a complete list, and says the tier classifiers will be refined over time. Generally available models without any tier keep conservative safeguards that block most cyber work but still allow code review, patching known issues, finding vulnerabilities in your own source and triaging alerts.
What does the benchmark actually show?
Anthropic ran Claude Opus 5.5 on ten multi-stage cyber challenges with five attempts each, fifty trials per tier. With no CVP access every task was blocked on the first prompt. With Defense Access 46 of 50 trials were blocked at some point and four succeeded. With Red Team Access there were no blocks and 34 of 50 tasks completed, which matches the model's 67.6 percent success rate with no safeguards at all; Anthropic says that figure is representative of Specialized Access. The useful reading is that Defense Access is a narrow lift, not a switch-off, and Red Team Access is in practice the unsafeguarded model for in-scope work.
What is the Cyber Mission?
Announced October 8 as a long-term commitment to securing critical infrastructure and open-source software. It launches with the Critical Infrastructure Defense Program, which brings frontier models, on-site engineers and threat research to operational technology defenders, with eleven founding partners including CrowdStrike, Dragos, Nozomi Networks, Palo Alto Networks and Rockwell Automation. It also launches OSS Scanner, a free opt-in service that periodically scans enrolled open-source projects and sends maintainers model-generated reports with a proof of concept and, where available, a suggested fix. Anthropic says the reports are sent without human review, expects a true-positive rate above 90 percent, and limits the service to projects that can keep up with the findings.
Is Anomity in the program?
Yes. Anomity was approved in the Cyber Verification Program on June 10, 2026, and we wrote about what verification does and does not change at the time. Under the new structure, existing members keep their settings for earlier models and are automatically evaluated for the new ones. We are not going to describe our own tier here; the point of this post is what the tiers mean for the teams that will apply.
How does Anomity help with this?
A tier is granted to an organization and assigned to workspaces by an administrator. It does not tell you which endpoints hold that access, whether an engineer is using a personal Claude account outside the verified workspace, or what the coding agents on those machines are doing with reduced blocking. The Anomity Endpoint Sensor inventories the agents, CLIs, MCP servers and local model runtimes on every managed machine; the Browser Sensor sees which AI web services are in use and whether the signed-in account is corporate or personal; and on agents with a pre-execution hook, such as Claude Code PreToolUse, Anomity allows, denies or logs a call before it runs, with a 90-day audit trail that routes to SIEM, Slack, email or Jira.
