Anthropic expands tiered access program for offensive cyber capabilities in Claude
Transformative AIIn its own announcement, the company said the program "makes advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals", with each tier including Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models. The move consolidates two schemes that had run in parallel for six months: Project Glasswing, which extended Claude Mythos access to organisations securing critical software, and the original CVP, which gave vetted teams reduced safeguards on Opus and Sonnet.
The three tiers scale with risk. Defense Access, the broadest, covers reverse-engineering malware, incident response and analysing vulnerabilities, open to company security teams, universities, government bodies, critical infrastructure operators and individual researchers with a track record of disclosed vulnerabilities, with Anthropic aiming to decide applications within days. Red Team Access adds authorised penetration testing but is currently restricted to organisations rather than individuals, with reviews expected to take a few weeks; applicants receive Defense Access in the interim. Specialized Access, which carries the fewest restrictions, is reserved for a limited set of verified organizations authorized to test safety systems that could impact people's lives or disrupt markets, such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks, and is reviewed jointly with the US government. Existing Project Glasswing members transition automatically into this top tier.
Anthropic tested the tiers against CyScenarioBench, an internal benchmark of multi-stage cyber operations. Without any programme access, every attempt was blocked at the first prompt; under Defense Access, 46 of the 50 trials were blocked at some point in the challenge, while the remaining four tasks succeeded. Under Red Team Access, blocks disappeared entirely, and Claude Opus 5.5 successfully completed 34 of the 50 tasks, which Anthropic described as effectively equivalent to the model's 67.6 percent success rate on the evaluation with no safeguards applied, a result the company says is representative of what Specialized Access permits.
On the defensive payoff, Anthropic said Project Glasswing partners identified a minimum of 129,000 verified software vulnerabilities from April through July 2026, of which more than 33,000 were rated critical- or high-severity, figures the company has called a likely undercount of the true impact by a factor of five. One industry breakdown put Anthropic's own scanning contribution at a further 5,500 more vulnerabilities on top of the partner total. The programme's growth has been rapid: as of June 2026, Project Glasswing covered roughly 150 organizations in more than 15 countries, up from about 50 at its April launch, spanning healthcare, energy, communications and other infrastructure sectors.
Access to the reduced-safeguard tiers comes with conditions. CVP participation requires data retention so Anthropic can monitor for misuse, and the programme is currently available through the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry, with Amazon Bedrock access limited to customers eligible for Anthropic's Enterprise Frontier Safeguards. The restructuring sits alongside a broader pattern in which frontier labs are becoming de facto gatekeepers of sanctioned offensive-security tooling, weighing the benefit of faster vulnerability discovery for defenders against the risk that removing safeguards, even for vetted users, widens the pool of actors capable of directing a model through sophisticated offensive operations.