Anthropic announced an expanded, application-based Cyber Verification Program (CVP) on October 6, 2026, with three tiers for different kinds of verified cybersecurity work. Individual researchers with a track record of reported vulnerabilities may qualify for Defense Access; Red Team Access is limited to organizations. Anthropic’s announcement also sets out the program’s safeguards, review expectations, platform options and data-retention terms.
The expansion follows Anthropic’s earlier restriction of Claude Mythos 5.1 to vetted users, covered in NeoTeo’s earlier report. Anthropic says the expanded program combines the earlier CVP and Project Glasswing. Its listed models are Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models, subject to each tier’s conditions.
What each access tier covers
| Access tier | Work covered | Who may qualify | Key condition |
| Defense Access | Security operations, incident response, malware reverse engineering, and vulnerability analysis and validation | Security teams, open-source maintainers, and individual researchers with a track record of reported vulnerabilities, among others | Applicants are verified and may need to provide evidence of security controls suited to the tier |
| Red Team Access | Authorized penetration testing and red teaming | Organizations; individual researchers are not eligible | Testing must be limited to systems the organization is authorized to assess. Real-time blocks remain for actions that could cause physical harm or mass disruption |
| Specialized Access | Testing safety-critical or market-sensitive systems | A limited set of verified organizations authorized to test those systems | Anthropic reviews applications in collaboration with the U.S. government |
Defense Access is the route for defensive work, including vulnerability analysis and incident response. Red Team Access adds authorized adversarial testing, but it does not remove every safeguard: Anthropic says real-time blocks remain for activities such as deploying ransomware, damaging physical systems or testing high-risk safety systems. Specialized Access has the fewest cyber blocks and covers a limited set of systems whose failure could affect lives or disrupt markets, including flight operations, power grids, telecommunications and interbank transfers.
Applying and waiting for a decision
Organizations apply through Anthropic’s CVP portal. Anthropic says it verifies applicants and asks for proof of controls appropriate to the requested tier. Individual researchers may apply for Defense Access if they have a track record of reported vulnerabilities; the organization-only rule applies to Red Team Access.
Anthropic aims to respond to Defense Access applications within a few days. It expects Red Team reviews to take a few weeks, and qualifying organizations receive Defense Access while their Red Team application is under review. These are stated aims and expectations, not guaranteed decision deadlines.
Existing CVP members retain their previous-model settings and are automatically evaluated for the named new models. Anthropic says current Project Glasswing members move to Specialized Access without reapproval for their current models; administrators assign access to workspaces.
Platforms and data-retention terms
Anthropic lists Claude Platform, Google Cloud Vertex AI and Microsoft Foundry for CVP access. Amazon Bedrock is limited to customers eligible for Enterprise Frontier Safeguards.
Anthropic says enrolled organizations must retain data for cyber-misuse monitoring. It also describes a zero-data-retention exception: until Enterprise Frontier Safeguards is available, organizations with applicable zero-data-retention access for Claude Fable 5.1 or Claude Mythos 5.1 can use CVP with zero data retention. Anthropic says the planned Enterprise Frontier Safeguards service will let eligible organizations use controlled cloud infrastructure.
What Anthropic reports from its evaluation
Anthropic’s CyScenarioBench evaluation used Claude Opus 5.5 on 10 challenges, with five attempts per challenge in each access tier. Without CVP access, Anthropic says all 50 trials were blocked on the first prompt. In Defense Access, 46 of 50 trials were blocked at some point and four tasks succeeded. In Red Team Access, Anthropic reports no blocks and 34 completed tasks out of 50.
Anthropic reports that Project Glasswing partners found at least 129,000 verified software vulnerabilities from April through July 2026. Its own open-source scanning identified an additional 5,500 from April through October 2026, and Anthropic says more than 33,000 findings were rated critical or high severity. The figures draw on a subset of partners and 33 reports, with different triage methods; fewer than half of partners disclosed patch counts, often because fixes were still in progress. Anthropic’s estimate that the true impact could be at least five times higher is based on that partial reporting.
