Anthropic bundles cyber programs and introduces three access levels

Anthropic is expanding its Cyber Verification Program (CVP). Security researchers and organizations will be able to use Claude capabilities through it in the future, depending on their access level, which are more restricted in the generally available models.

Previously, there were two separate programs for this. Through Project Glasswing , selected organizations received access to Claude Mythos, a model variant with extended cyber capabilities that was only available to a limited extent. Through the CVP, verified security teams could use Claude Opus and Sonnet with less restrictive cyber filters. It only knew one access level.

Anthropic is now merging both approaches into an expanded CVP and dividing access into three levels. All three include Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1, as well as further models in the future. Existing Glasswing participants will move to the highest level.

Anthropic is thus responding to the dual-use problem of cyber AI: the same capabilities can find and secure vulnerabilities but also be misused for attacks. Therefore, the company is increasingly linking access to verification and the scope of cyber work in the future.

The lowest access level (“Defense Access”) is aimed at defensive tasks such as handling security incidents, malware analysis, reverse engineering, or the analysis and validation of vulnerabilities. In addition to organizations, individual security researchers can apply for this, provided they have already demonstrably reported vulnerabilities.

The intermediate access level (“Red Team Access”) additionally allows authorized penetration tests and red teaming and is only open to organizations. The highest access level (“Specialized Access”) is intended for particularly sensitive tests, for example on power grids, flight operating systems, telecommunications networks, or infrastructure for interbank transfers. According to the company, Anthropic checks applicants for this highest level together with the US government.

Anthropic demonstrates how differently the cyber filters of the access levels intervene with Claude Opus 5.5 on CyScenarioBench, a benchmark for multi-stage offensive cyber operations. Without CVP, all 50 attempts were blocked on the first prompt. With Defense Access, the filter intervened in 46 out of 50 runs. With Red Team Access, however, none of the 50 attempts were blocked.

Anthropic’s terms of use continue to apply in full. Even with Red Team Access, real-time filters are intended to block the use of ransomware and actions with possible physical damage, among other things.

Accompanying the reorganization, Anthropic is announcing new results from Project Glasswing. Partners found at least 129,000 verified software vulnerabilities between April and July. An additional 5,500 were added between April and October during its scans of open-source software. More than 33,000 of the identified vulnerabilities have so far been classified as critical or high.

The partner figures are based on incomplete data from 33 partner reports. Anthropic therefore describes the results as a lower limit.

This article was originally published in German . It was translated with technical assistance and editorially reviewed before publication.