On October 6, 2026, Anthropic announced an expanded Cyber Verification Program, or CVP, allowing qualified security professionals to apply for different levels of advanced cyber capabilities and reduced blocking classifiers. The program now has three access tiers, with model capabilities, verification requirements, and security controls matched to the scope of an organization’s cyber work. The tiers include Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models.
Anthropic describes cybersecurity as a dual-use domain: the same capability can help defenders find and fix vulnerabilities or help a malicious actor attack them. Generally available models therefore retain conservative cyber safeguards, while CVP places stronger capabilities behind reviewed access tiers. Defense Access is intended for security operations, incident response, malware reverse engineering, and vulnerability analysis and validation. Qualifying applicants can include companies, nonprofits, universities, governments, critical-infrastructure operators, open-source maintainers, and researchers with a history of disclosed vulnerabilities.
The program is not simply a global guardrail switch. It combines model capability, applicant verification, workspace assignment, and misuse monitoring. Anthropic says enrolled organizations must be verified and demonstrate the security controls required for the relevant access tier; administrators must also assign access to specific workspaces. Data-retention monitoring is required for organizations enrolled in the program until Enterprise Frontier Safeguards becomes available, with different zero-data-retention arrangements for some specified models and configurations.
Anthropic used CyScenarioBench to test blocking behavior across tiers. The evaluation includes 10 multi-stage cyber challenges, with five attempts per tier: all 50 attempts without CVP access were blocked on the first prompt; 46 of 50 Defense Access trials were blocked at some point, with four completing; and Red Team Access had no blocks and completed 34 of 50 trials. These are Anthropic’s model-and-policy evaluation results, not a guarantee of real-world security, and the announcement does not provide actionable attack instructions.
Anthropic also shared an early impact estimate from Project Glasswing. Partners reported at least 129,000 verified software vulnerabilities between April and July 2026, while Anthropic’s own open-source scanning found another 5,500 between April and October; more than 33,000 were rated critical or high severity. The post says the numbers come from only 33 partner reports, with different triage approaches and fewer than half of partners disclosing patched counts. They should therefore be read as a partial-data lower bound, not a complete market statistic.
The update points to a more mature form of agent governance: powerful capabilities need not be opened to everyone, but dual-use risk also cannot be handled by one global switch. Tiered access, organizational verification, workspace permissions, data retention, misuse monitoring, and ongoing evaluation need to be designed together. For adopters, confirming the permitted use, controls, records, and escalation path matters more than treating a benchmark completion rate as a safety verdict.
