Anthropic expands Cyber Verification Program

Anthropic's Cyber Verification Program (CVP) now sorts applicants into three tiers, each unlocking a different degree of freedom from the company's default safety restrictions. Defense Access, the entry tier, is open to corporate security teams, nonprofits, universities, government bodies, critical infrastructure operators, small security firms, open-source maintainers, and even individual researchers who can point to a track record of vulnerability disclosures; it covers SOC and incident-response work, malware reverse-engineering, and vulnerability analysis, with review taking 'a few days.'^[1]Red Team Access goes further, adding authorized penetration testing and red-teaming, but it is restricted to organizations rather than individuals and takes a few weeks to clear - real-time blocks still trigger for anything resembling physical harm, mass disruption, ransomware deployment, or attacks on high-risk safety systems.^[1]The top tier, Specialized Access, is reserved for organizations cleared to test safety-critical infrastructure - flight systems, power grids, telecom networks, interbank transfer rails, and government networks - vetted in direct collaboration with the U.S. government; existing Project Glasswing members, the coalition Anthropic quietly built with partners including AWS, Cisco, JPMorganChase, Microsoft, and Nvidia, transition into this tier automatically.^[1]All three tiers currently include Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1, with more models promised over time.^[1]

The clearest evidence of what 'fewer restrictions' actually means comes from Anthropic's own CyScenarioBench testing. With no CVP access at all, Claude Opus 5.5 was blocked on all 50 offensive-security trial tasks before it could even begin. Under Defense Access, the model still got blocked on 46 of 50 trials, completing just 4. Under Red Team Access, the blocking disappeared entirely - zero blocks - and the model completed 34 of 50 tasks, a 67.6 percent success rate that Anthropic says matches how the model performs with no safety safeguards whatsoever.^[2]That is the real headline buried in a program framed as 'extending the impact' of defensive security work: for a vetted red team, Claude's offensive capability ceiling is identical to an unrestricted model.^[1]IDC research director Sakshi Grover flagged a wrinkle in how that number should be read - the benchmark is Anthropic's own, not independently audited, and she argued that whether a given sequence of actions is legitimate red-teaming or an actual attack depends on authorization, target scope, and execution conditions that outsiders can't verify from the score alone.^[2]Anthropic also estimates the defensive side of the ledger is underreported, saying partner-survey data suggests the true vulnerability-discovery impact of the program runs at least five times higher than the official count.^[2]

Two cybersecurity researchers interviewed alongside the launch backed the tiered structure only with caveats. IDC's Deepika Giri said the model works only with continuous access review, distinct short-lived agent identities, full observability, and human oversight of high-impact actions, warning that an agent's behavior can drift over time even after it clears vetting.^[2]Red-teamer Vibhum Dubey raised a related accountability question: organizations granted expanded access still need to define, in advance, who is responsible when an autonomous AI system takes a consequential action.^[2]Anthropic's own user base is testing that gap in real time. Reception split between relief that individual bug-hunters can now qualify and frustration that the bar for entry seems arbitrary - one user described getting accepted into the program simply by describing their use case as 'homework,' while another, a penetration tester who had collected roughly $10,000 in bug bounty payouts across six accepted vulnerability reports, said they were rejected. That inconsistency, more than any policy language, is what's fueling skepticism that 'vetted' means something more rigorous than a short application form.

The program's headline defensive numbers are large: Project Glasswing partners surfaced more than 129,000 verified vulnerabilities between April and July 2026, and Anthropic's own open-source scanning added roughly 5,500 more through October, with over 33,000 of the combined total rated critical or high severity.^[1]But volume of discovery is not the same as real-world danger. Of the roughly 300 CVEs Anthropic has been credited with surfacing, independent tracking found only two - a Ghost CMS SQL injection flaw (CVE-2026-26980) and a Rejetto HTTP File Server session-forgery bug (CVE-2026-61500) - have actually seen active exploitation in the wild, a rate of under 1 percent.^[3]That gap is part of why Anthropic is pairing expanded access with new guardrails on the data side: enrolling in CVP requires organizations to accept data retention for misuse monitoring, a tradeoff Anthropic plans to soften later this year with Enterprise Frontier Safeguards, which will allow zero-retention storage inside a customer's own cloud infrastructure.^[1]