Anthropic sets three tiers of Claude cyber access for defenders

Anthropic has reorganised the way security teams can use its most advanced models for cyber work. Project Glasswing and the Cyber Verification Program (CVP), until now two separate tracks, are merging into a single programme with three verified access tiers: Defense Access, Red Team Access and Specialized Access. The higher the tier, the fewer blocks the model applies to offensive requests.

There are no CVEs to fix and no products to update. The news matters to SOCs, red teams and critical infrastructure operators weighing AI for security work, and to whoever has to govern the risks.

What happened

According to Cybersecurity360 the announcement came on 6 October 2026; the other outlets covered it on 7 October. Both programmes started in April 2026, alongside the Claude Mythos model:

• Glasswing gave selected organisations working on critical software access to Mythos to look for vulnerabilities in their own systems;
• the CVP gave vetted security teams access to the Opus and Sonnet models with reduced safeguards.

The publicly available models (Claude Opus 5.5, Fable 5.1 and Sonnet 5.5) keep conservative cyber safeguards that block most offensive activity. According to Cybersecurity360 they still allow tasks such as code review, fixing known issues, finding vulnerabilities in your own code and alert triage. Each tier of the new programme instead includes Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models, with different restrictions.

The three tiers

• Defense Access: security operations, incident response, malware reverse engineering, vulnerability analysis and validation. It is meant for teams at companies, non-profits, universities and public bodies protecting their own systems, critical infrastructure operators of any size (the announcement mentions a regional hospital and a municipal utility), open-source maintainers and researchers with a track record. Anthropic expects to respond within a few days.
• Red Team Access: adds authorised penetration testing and red teaming, only on systems the organisation is authorised to test, and is reserved for organisations. Real-time blocks remain on actions that could cause physical harm or mass disruption, such as deploying ransomware or testing high-risk safety systems. Review takes weeks; according to Cybersecurity360, applicants are enrolled in Defense Access in the meantime.
• Specialized Access: the tier with the fewest restrictions, for a small number of verified organisations authorised to test systems such as flight operating systems, power grids, telecommunications, interbank transfers and government administrative networks. Applications are reviewed together with the US government. Current Glasswing members move to this tier without new approval for the models they already use.

Anthropic’s own figures

Anthropic measured the tiers with CyScenarioBench, its internal benchmark of multi-stage cyber operations: Claude Opus 5.5, 10 challenges, 5 attempts per challenge and per tier, so 50 trials each.

• No CVP: every trial blocked at the first prompt.
• Defense Access: 46 trials blocked at some point, 4 successful.
• Red Team Access: no blocks, 34 trials completed.

According to the company, the Red Team Access result matches the 67.6% success rate measured with no safeguards, which is the expected behaviour for Specialized Access. Sakshi Grover of IDC, speaking to CSO Online, points out that this is a vendor-run test, not an independent one.

On Glasswing’s results, Anthropic says partners found at least 129,000 verified vulnerabilities between April and July 2026, plus 5,500 found between April and October by the company’s own scans of open-source projects. More than 33,000 have been rated critical or high severity so far. The company considers this an undercount and expects the real impact to be at least five times higher.

The sources urge caution. According to Cybersecurity360 the data comes from 33 partner reports with differing triage criteria. The Register reports Anthropic figures showing that, out of 5,674 confirmed vulnerabilities, 516 have been fixed, and quotes Patrick Garrity of VulnCheck: fewer than 0.5% of the 225 Anthropic-linked vulnerabilities he tracks are exploited in real attacks. The bottleneck is shifting from discovery to remediation.

The technical picture: controls move outside the model

The sources describe no attacks or indicators, and there is no attack chain to map to MITRE ATT&CK. The technical point is a different one: the steps of a penetration test are the same as those of an attack. As Grover notes, what makes them legitimate is authorisation, scope and execution conditions, not the technique. When the model refuses less, the controls have to sit outside the model.

For CVP participants data retention is mandatory, so that Anthropic can detect misuse. The company has announced Enterprise Frontier Safeguards, which will combine zero data retention with additional safeguards and let organisations keep data on cloud infrastructure they control. Those who already have zero data retention on Fable 5.1 or Mythos 5.1 can use the CVP on the same terms. According to Cybersecurity360 the programme is available on Claude Platform, Google Cloud’s Vertex AI and Microsoft Foundry, and on Amazon Bedrock only for customers eligible for the new safeguards.

Impact for European and Italian companies

• GDPR: prompts and responses from security work may contain logs, code, personal data and unpatched vulnerabilities. With mandatory retention, processing roles, agreements with the provider, transfers outside the EU and minimisation all need to be clarified. In healthcare, incident logs may contain health data.
• Specialized Access: it is vetted together with the US government and, according to Cybersecurity360, the announcement does not clarify geographic eligibility. This needs checking for operators of power grids, telecommunications or financial infrastructure subject to NIS2, DORA and the Critical Entities Resilience Directive.
• NIS2: access with reduced safeguards is both a critical supply and an elevated privilege, to be covered by the risk management and supply chain security measures of Article 21.

What to do now

1. Choose the tier that matches your actual work, not the highest one: SOC, incident response and malware analysis fall under Defense Access.
2. For Red Team Access, document first the contracts, scope and rules of engagement for the systems to be tested.
3. Treat access as an elevated privilege: dedicated environments, identified people, logged usage, and an entry in the risk register.
4. Put controls around agents: a distinct identity for each agent, short-lived privileges tied to a single task, independent checks of targets and actions, human approval for high-impact actions and a named owner, as suggested by the analysts quoted by CSO Online.
5. Before sending logs, code or incident data, review the data protection impact assessment and minimise; in the most sensitive contexts consider zero data retention.
6. Size your vulnerability management: if discovery speeds up, triage, prioritisation and patching must keep up with the volume.

How ARXDOME helps

ARX Shield shows open vulnerabilities by machine and by package, with their age and with those already exploited by attackers highlighted: when findings pile up, it helps decide what to fix first. ARX Expose adds the outside view, with known vulnerabilities on public services, to separate what is exposed from what is not.

Last updated: 8 October 2026