Anthropic Expands Cyber Verification Program to Three Tiers
Anthropic now offers three access tiers — Defense Access, Red Team Access, and Specialized Access — that give vetted security teams reduced cyber blocks on Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1. Know which tier fits your work so you ask Claude for the right thing instead of fighting its safeguards.
What shipped: On October 6, 2026, Anthropic launched an expanded Cyber Verification Program (CVP). It merges two prior programs — Project Glasswing and the original CVP — into one application with three access tiers. Each tier unlocks different cyber capabilities on Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1.
Why this matters to you: Claude's generally available models (Opus 5.5, Fable 5.1, Sonnet 5.5) run conservative safeguards that block most cyber work — even legitimate security work like analyzing malware or writing exploit code for authorized testing. If you do security work, knowing these tiers exist changes what you ask Claude for.
The three tiers:
Defense Access — defensive work: SOC/incident response, reverse-engineering malware, analyzing and validating vulnerabilities. Qualifies: company/nonprofit/university/government security teams defending their own systems, critical infrastructure operators, smaller security firms, open-source maintainers, individual researchers with a reported-vulnerability track record. Anthropic aims to respond within a few days.
Red Team Access — adds authorized penetration testing and red-teaming, but only against systems you're authorized to test. Qualifies: in-house and government red teams, pentesting firms (organizations only, for now). Real-time blocks still apply to actions that could cause physical harm or mass disruption — e.g., deploying ransomware or pen-testing high-risk safety systems. Review takes a few weeks; you get Defense Access while you wait.
Specialized Access — fewest blocks, reserved for organizations authorized to test safety-critical systems (flight systems, power grids, telecom, interbank transfer infrastructure, government networks). Reviewed jointly with the US government. Existing Project Glasswing members move here automatically.
The evidence behind the tiers: Anthropic ran Claude Opus 5.5 through CyScenarioBench (a benchmark for multi-stage cyber operations) five times across 10 challenges at each tier. Without CVP access, every task was blocked on the first prompt. In Defense Access, 46 of 50 trials were blocked at some point (4 succeeded). In Red Team Access, zero blocks occurred, and Opus 5.5 completed 34 of 50 tasks — the same 67.6% success rate as with no safeguards at all.
Project Glasswing (the predecessor defensive program) shows the upside: partners found at least 129,000 verified software vulnerabilities between April and July 2026, plus 5,500 more from Anthropic's own open-source scanning through October. Over 33,000 of these were rated critical or high severity.
What to do in practice: If Claude blocks security work you're authorized to do, don't try to prompt your way around it (roleplay, hypotheticals, jailbreak phrasing) — that's not what the block is testing for, and it won't get you reliable results. Instead, apply for the CVP tier that matches your work at the link Anthropic provides, or report the block via their reporting form if you believe your tier should already allow it.
One catch: CVP requires data retention so Anthropic can monitor for misuse. If you need zero data retention, that's only available today via Claude Fable 5.1 or Mythos 5.1 — a broader zero-retention option (Enterprise Frontier Safeguards) is coming later this fall. Your generally available Claude access still covers code review, patching known issues, and triaging security alerts — no application needed for that.
Three tiers, three use cases: Defense Access for defending your own systems, Red Team Access for authorized offensive testing, Specialized Access for safety-critical infrastructure. If Claude blocks legitimate security work, the fix is applying for the right tier — not rephrasing your prompt to dodge the safeguard.