Anthropic is releasing a new, expanded Cyber Verification Program (CVP). It gives qualifying security professionals advanced cyber capabilities and fewer blocking classifiers. The program now has three access tiers, so security teams can apply for the level that fits their work. Every tier includes Anthropic's most capable models: Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models. Interested customers can apply here.
Cybersecurity is dual use. The capabilities that let a security team find and fix a vulnerability can also help an attacker exploit it. For that reason, Anthropic's generally available models, including Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5, have conservative cyber safeguards that block most cyber work. The aim is to limit the harm malicious actors can do with Anthropic's models. Anthropic is also continuing to reduce false positives for secure coding.
Defenders still need the best tools. Over the past six months, Anthropic has offered trusted access through two programs: Project Glasswing and the CVP. Glasswing gave organizations securing the most critical software access to Claude Mythos. The CVP gave vetted security teams reduced safeguards on Claude Opus and Claude Sonnet models. Anthropic is now merging them into one expanded offering that gives more security organizations the capabilities they need.
New access tiers
Each tier makes specific model capabilities available based on the scope of a team's cyber work. Each has its own verification requirements and security controls.
Defense Access covers defensive work. This includes security operations center and incident response tasks, malware reverse-engineering, and vulnerability analysis and validation. Qualifying organizations include:
- security teams at companies, nonprofits, universities and government bodies defending systems they own or maintain
- critical infrastructure operators of any size, such as regional hospitals or municipal utilities
- smaller security firms
- open-source maintainers
- individual researchers with a track record of reported vulnerabilities
Anthropic expects many organizations doing defensive work to qualify. It aims to respond to applications within a few days.
Red Team Access adds authorized penetration testing and red-teaming to the defensive uses above. Qualifying organizations include in-house red teams, government red teams, and security and penetration testing firms. They may only run adversarial tests against systems they are authorized to test, including IT systems in critical industries. Real-time blocks still apply to actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or pen testing high-risk safety systems.
This tier has stricter eligibility requirements and security controls, so Anthropic expects reviews to take a few weeks. Qualifying organizations are enrolled in Defense Access while their Red Team Access applications are reviewed. For now, this tier is open to organizations only, not individual researchers.
Specialized Access has the fewest cyber blocks. It is reserved for a limited set of verified organizations authorized to test safety systems that could affect people's lives or disrupt markets. Examples include flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks.
Anthropic currently reviews every organization for this tier in depth, working with the US government. Existing Project Glasswing members will move to this tier and will not need reapproval for current models.
Generally available models can still be used for code review, patching known issues, finding vulnerabilities in owned source code, and triaging security alerts.
Organizations in the program must allow data retention so Anthropic can monitor for cyber misuse. Enterprise Frontier Safeguards (EFS) combines the privacy of zero data retention with robust safeguards. When it becomes available later this fall, eligible organizations will be able to store data in cloud infrastructure they control. Until then, organizations with zero data retention access to Claude Fable 5.1 or Claude Mythos 5.1 can also use the CVP with zero data retention. To register interest in EFS, fill out this form.
An overview of what each tier offers, along with its security and privacy control requirements, is shown below.
Testing how well the tiers work
To check the CVP protections, Anthropic ran Claude Opus 5.5 through CyScenarioBench. This evaluation measures whether models can plan and execute multi-stage cyber operations under realistic constraints. Safeguards were tuned for each tier. The scenarios are complex, interactive and offensive, so Anthropic expected significant blocks on the generally available model and in Defense Access, and none in Red Team Access and Specialized Access.
Each of the 10 challenges was attempted five times per tier. The results:
- Without CVP access, every task was blocked on the first prompt.
- In Defense Access, 46 of 50 trials were blocked at some point, and the other four succeeded.
- In Red Team Access, nothing was blocked and Claude Opus 5.5 completed 34 of 50 tasks. This is effectively the same as its 67.6% success rate with no safeguards, which represents Specialized Access.
These results give Anthropic confidence that it can safely offer advanced cyber capabilities to a wider set of defenders, building on the work begun with Project Glasswing. It will keep refining its tier-based classifiers.
On CyScenarioBench, Anthropic's safeguards blocked 46 of 50 tasks on Claude Opus 5.5 in Defense Access. Red Team Access blocked none and completed 34 of 50, the same rate as with no safeguards.
Giving defenders the advantage
Through Project Glasswing, Anthropic found that Claude Mythos models greatly sped up how quickly organizations could identify vulnerabilities in their systems. Partners found at least 129,000 verified software vulnerabilities between April and July 2026. Anthropic's own open-source scanning found another 5,500 between April and October 2026. More than 33,000 of these have so far been rated critical or high severity. The figure is likely an undercount because it rests on survey data from only some Glasswing partners, and Anthropic expects the true impact to be at least five times higher.
Several partners were asked how long it would have taken to find the same number of vulnerabilities without Claude Mythos models. They said the models sped up their vulnerability finding by months or even years. Read more about the experience of Booz Allen and Comcast.
These results are a lower bound on the program's impact on third-party code. They draw on partial data from 33 partner reports and Anthropic's open-source partnerships. Organizations triaged in different ways. Fewer than 50% of partners disclosed patch numbers, often because fixes were still in progress, so the patch rate is significantly undercounted.
The CVP changes announced today are meant to extend Glasswing's impact to many more cyber defenders. Anthropic is also continuing its work to help secure open-source software and critical infrastructure. In the coming weeks it will share more about that work and what it has learned, as it works to give defenders a permanent advantage.
Apply for access
Interested organizations can apply to the CVP here. Anthropic will verify all applicants and request proof of the security controls required for the relevant tier. Existing CVP members keep their current settings for previous models. They will be automatically evaluated for access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1 under the updated program. Admins must assign access to specific workspaces by following these steps.
The CVP is available on the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry. On Amazon Bedrock, it is available only to customers eligible for Enterprise Frontier Safeguards.
If you are blocked on work you think your tier should allow, you can report it here. Full details on each tier are in Anthropic's Help Center.