The Anthropic Cyber Verification Program expanded on October 6, 2026, with three access tiers for verified cybersecurity professionals and organizations. The change is designed to let qualified defenders use advanced Claude models for vulnerability research, incident response and authorized security testing while keeping stronger restrictions around higher-risk activity.
The announcement matters because AI security tools can help both defenders and attackers. Rather than offering identical permissions to every user, the company is tying more capable cybersecurity workflows to verification, authorization and different safeguards.
What changed in the Anthropic Cyber Verification Program?
The updated program brings Anthropic’s earlier Cyber Verification Program and Project Glasswing efforts into a broader tiered arrangement. Anthropic says the new structure offers Defense Access, Red Team Access and Specialized Access, with each level reflecting different verification requirements and security controls.
Access can include advanced models such as Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1, with future models added as appropriate. That does not mean every applicant receives every capability immediately. Qualification, approval and the type of security work being performed determine the available level.
The central distinction is between ordinary AI access and vetted access for specific security work. Cybersecurity tasks are often dual-use: investigating a vulnerability can resemble exploiting it. Anthropic says its generally available models keep conservative safeguards, while vetted defenders can seek more appropriate permissions.
Who qualifies for Defense Access?
Defense Access is the entry tier for eligible security professionals performing legitimate defensive work. Anthropic lists security operations, incident response, malware analysis, reverse engineering, and finding or validating vulnerabilities among the intended uses.
Potential applicants include security teams at companies, nonprofits, universities and government bodies; operators of critical infrastructure such as hospitals and utilities; smaller security firms; open-source maintainers; and individual researchers with a record of responsible vulnerability reporting.
The company says it expects many genuine defenders to qualify and aims to respond to applications within days. That is a stated target, not a guaranteed turnaround. Applicants should prepare evidence of their role and the systems they protect, rather than assume a job title alone is enough.
What is Red Team Access?
Red Team Access is intended for organizations conducting authorized penetration testing and adversarial security assessments. It builds on defensive permissions but can permit a wider range of realistic tests, subject to authorization and safeguards.
Anthropic explicitly limits this tier to organizations at present, excluding individual researchers. It also says applicants may be placed in Defense Access while their more demanding Red Team review continues, which the company expects can take weeks.
Authorization is a core boundary. A model being able to assist with a task does not grant permission to test somebody else’s systems. Even in the red-team tier, the company says actions that could cause physical harm or mass disruption remain blocked.
What makes Specialized Access different?
Specialized Access is the most tightly controlled tier and has the fewest cyber-specific blocks. It is reserved for a limited number of verified organizations working on safety-critical systems whose failure could affect lives, essential services or markets.
Examples in the announcement include aviation systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. Anthropic says it reviews organizations for this tier in depth alongside the U.S. government.
Existing Project Glasswing members transition into this tier for their current models without needing a fresh approval process. The narrow eligibility reflects the risks of granting stronger tools for systems where a mistake or misuse could have consequences far beyond one software application.
Why does Anthropic think advanced AI can help defenders?
Security teams face an enormous volume of software code, configuration changes, alerts and potential vulnerabilities. A capable AI assistant can help analysts review code, prioritize findings, explain technical patterns and draft remediation work. It can also speed repetitive investigation steps when paired with human review.
Anthropic reports that partners in its earlier Project Glasswing effort uncovered at least 129,000 verified software vulnerabilities between April and July 2026. It says its own open-source scanning identified another 5,500 verified vulnerabilities between April and October. More than 33,000 of the combined verified findings had been rated high or critical severity.
These figures come from the company’s own announcement. They show the scale Anthropic reports, not an independently audited measure of how many vulnerabilities were uniquely caused or prevented by AI. Finding a vulnerability is not the same as proving it was exploited or that every issue has been fixed.
How are the safeguards different between tiers?
Anthropic describes different classifier behavior based on the access level. In one company-reported benchmark, its Defense Access safeguards blocked 46 of 50 cyber tasks, while the Red Team tier did not block those same tasks and completed 34 of 50. The company says this matched its completion rate without safeguards in that evaluation.
The benchmark illustrates a policy and capability trade-off, but readers should avoid turning one test into a general security ranking. Real environments vary in tooling, data quality, authorization, and the complexity of vulnerabilities. An AI system can also be mistaken, overconfident or unable to validate a proposed fix.
Security organizations still need established processes for asset ownership, testing permissions, change control, peer review, incident escalation and evidence retention. More model access does not replace professional judgment or organizational accountability.
How can organizations apply?
The Anthropic Cyber Verification Program uses an application and verification process for interested security professionals and organizations. Anthropic directs applicants to its official application portal. Applicants should describe their legitimate security work and be prepared to provide evidence of the relevant controls. The company says current CVP members retain their existing settings for previous models and are evaluated for the updated access options.
Anthropic also requires data retention to monitor potential misuse for most enrolled organizations; it describes limited existing zero-retention exceptions and future Enterprise Frontier Safeguards options. Applicants should check privacy and data-handling requirements before supplying sensitive information. Administrators may need to assign the permitted access to specific workspaces. That separation matters in larger companies where some teams have authorized security responsibilities while others do not. A broad organization-wide permission would be harder to govern.
Anthropic says the program is available through the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry, with more limited Amazon Bedrock eligibility tied to Enterprise Frontier Safeguards. Buyers should verify provider-specific availability and contract terms before planning a deployment.
What does this mean for the AI security industry?
The Anthropic Cyber Verification Program is an access policy, not proof that AI has solved cybersecurity. It signals a broader move toward role-based AI capabilities in sensitive domains. Instead of treating all security prompts as equally safe or dangerous, providers may increasingly evaluate the user, the target system and the intended workflow.
For defenders, tiered access could reduce frustrating false blocks when investigating systems they own. For providers, it introduces operational work: verifying applicants, auditing use, enforcing permissions and responding when access is misused. Both sides have to make the controls work in practice.
Over time, the quality of the program will depend on whether verified teams can find and fix meaningful issues faster without creating new abuse paths. Independent research, incident reporting and clear transparency about failures will be important.
What should readers watch next?
Anthropic says it plans to publish more findings from its defensive security work. Organizations considering the program should watch for updated eligibility guidance, application timelines, supported models, audit requirements and evidence of measurable security outcomes.
Individuals should distinguish Defense Access, which may include qualifying independent researchers, from Red Team and Specialized Access, which have tighter organizational restrictions. Applying for Anthropic Cyber Verification Program access is not the same as receiving approval.
Bottom line: the October 6 expansion gives vetted security teams a more structured way to use powerful AI models. It is a meaningful policy development, but the real test will be safer, verifiable improvements to defensive security work.
Related coverage and primary source
For related Anthropic coverage, read our Claude AI engineering academy guide and Claude Haiku 5.5 analysis. These cover separate Anthropic initiatives, not Cyber Verification Program eligibility.
Anthropic’s October 6, 2026 Cyber Verification Program announcement. Statistics and program descriptions attributed to Anthropic are company-reported.