Claude Cyber Verification Program 2026: The 3 Tiers Explained

The Claude Cyber Verification Program just got a lot bigger, and it changes who can point Anthropic’s strongest models at real exploit work. Anthropic has rebuilt the program into three access tiers and merged Project Glasswing into it. Vetted defenders, red teams and critical-infrastructure testers now use one application to reach Opus 5.5, Sonnet 5.5 and Mythos 5.1 with fewer cyber safeguards in the way. The change follows Glasswing partners reporting at least 129,000 verified vulnerabilities in four months. If your team does vulnerability research, incident response or penetration testing, the question is no longer whether frontier AI belongs in your workflow. It’s which tier you can get and how quickly.

What’s actually new in the Claude Cyber Verification Program

Until this week, Anthropic ran two separate tracks. The original Cyber Verification Program (CVP) relaxed safeguards on Opus and Sonnet for approved security teams. Project Glasswing was a separate, mostly invite-only effort that gave organizations securing critical software access to Claude Mythos. According to SecurityWeek, the two are now one program with three levels. Each level covers Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models.

The tiers increase in permissiveness:

• Defense Access is the entry tier. It covers SOC and incident response work, malware reverse engineering, and vulnerability analysis and validation. It’s open to security teams defending systems they own or maintain: companies, universities, government bodies, critical infrastructure operators as small as a regional hospital, small security firms, open source maintainers, and individual researchers with a track record of reported vulnerabilities.
• Red Team Access adds authorized penetration testing and red teaming, limited to systems the organization has permission to test.
• Specialized Access has the fewest cyber blocks and the narrowest eligibility. It’s for organizations cleared to test safety-critical systems such as power grids and telecom networks. Anthropic says these reviews currently happen in collaboration with the U.S. government.

The Glasswing tally drives the expansion. Reported figures put partner findings at 129,000 or more verified vulnerabilities between April and July 2026, with over 33,000 rated critical or high severity. Anthropic’s own open-source scanning found roughly 5,500 more. Results at that scale suggest that restricting these models mostly slowed defenders down, so Anthropic is widening the door. The guardrails remain: even at Red Team Access, real-time classifiers still block requests that drift toward actions like ransomware deployment, as Help Net Security reports.

Why it matters

• Small defenders get frontier-grade tooling. Defense Access explicitly names open source maintainers, small firms and individual researchers. Mythos-class capability previously went mostly to large Glasswing partners. Now a two-person security shop maintaining a popular library can apply.
• Fewer refusals on legitimate work. Anyone who has asked a general-purpose model to analyze a malware sample or validate a proof of concept knows what refusal friction costs. Verified tiers should remove most of it for in-scope work, which matters more for daily throughput than any benchmark.
• Offensive testing is now an official use case. Red Team Access turns Claude-assisted penetration testing from a gray area into a sanctioned path. Expect it to appear in engagement letters and rules of engagement.
• Patch volume becomes the bottleneck. If AI-assisted discovery produces tens of thousands of verified bugs per quarter, triage, disclosure and patching capacity become the limit. Maintainers will feel this first.
• The dual-use policy is now a template. Anthropic’s approach comes down to three steps: verify the user, scope the permission, and keep classifiers on as a backstop. Regulators and competitors will copy it or argue against it.
• Government is in the loop at the top tier. Specialized Access reviews involve the U.S. government. That reassures U.S. critical infrastructure operators and raises compliance questions for everyone else.

How to use it today

None of the reporting describes a separate “cyber endpoint.” Verification attaches to your organization, so once approved you keep calling the standard Claude API.

1. Pick the right tier before you apply. Apply for the lowest tier that covers your actual work. If you only triage alerts, reverse malware and validate CVEs on your own estate, choose Defense Access. If you run client pentests under signed scope, you need Red Team Access. Over-asking slows review. Anthropic says it aims to answer Defense Access applications within a few days.
2. Assemble your evidence packet. Reviewers want proof of legitimacy and scope. Have this ready before you start the form:

   CVP application checklist
   - Legal entity name, website, primary security contact
   - Anthropic Console organization ID the access should attach to
   - Description of systems you own/maintain (or client authorization model)
   - For researchers: links to CVEs, advisories, bug bounty profiles
   - For Red Team tier: sample rules-of-engagement / scope letter template
   - Internal policy for handling exploit code and sensitive findings
   - Data handling: where model outputs and samples are stored

3. Confirm which models your org can reach. After approval, check the models list on your API key so you only hardcode IDs available to your organization:

   curl https://api.anthropic.com/v1/models \
     -H "x-api-key: $ANTHROPIC_API_KEY" \
     -H "anthropic-version: 2023-06-01"

4. Wire up a scoped triage call. Put the authorization context in the system prompt. It bypasses nothing, but it keeps the model inside your engagement and gives you an audit trail.

   import anthropic
   
   client = anthropic.Anthropic()
   
   SYSTEM = """You are assisting the internal security team at ExampleCorp.
   Scope: systems listed in asset inventory INV-2026-Q4 only.
   Task type: vulnerability analysis and validation (defensive).
   Output: severity (CVSS v4), root cause, reachable attack path,
   minimal safe reproduction steps, and a recommended patch."""
   
   with open("crash_report.txt") as f:
       report = f.read()
   
   msg = client.messages.create(
       model="claude-opus-5-5",
       max_tokens=4000,
       system=SYSTEM,
       messages=[{"role": "user",
                  "content": f"Triage this fuzzer crash:\n\n{report}"}],
   )
   print(msg.content[0].text)

5. Use a structured prompt for code audits. Most Glasswing-scale results came from systematic codebase sweeps, not one-off questions. A reusable prompt keeps output consistent enough to feed a tracker:

   Audit the following file for memory-safety, injection, auth bypass,
   and logic flaws. For each finding return JSON:
   {"id": "", "file": "", "line": 0, "class": "", "severity": "",
    "confidence": "high|medium|low", "evidence": "", "fix": ""}
   Only report issues you can tie to a concrete code path.
   Mark anything speculative as confidence "low".

6. Build disclosure capacity before you scale. Cap findings per maintainer per week and route everything through human validation. Flooding an open source project with 400 AI-generated reports burns the goodwill this program depends on.
7. Log everything. Keep prompts, outputs and scope references for each engagement. If a classifier blocks a legitimate request, you’ll have the context to escalate it. If a client asks how a finding was produced, you’ll have the answer.

How it compares

Other labs run vetted-access programs for security work, but they’re structured differently. The table below summarizes public positioning. Check each vendor’s current terms before you commit.

Program	Who it’s for	Offensive testing	Access model
Anthropic Cyber Verification Program	Defenders, red teams, critical-infrastructure testers, individual researchers	Yes, from Red Team tier, scoped to authorized systems	Three tiers; Glasswing folded in; classifiers stay on
OpenAI Trusted Access for Cyber	Vetted security professionals and organizations	Defensive focus with relaxed limits for verified users	Identity/organization verification gating more permissive model behavior
Google security AI (Big Sleep, Sec-Gemini)	Largely internal research and select partners	Internal vulnerability discovery	Limited external availability
Open-weight models, self-hosted	Anyone	Unrestricted by vendor	No verification, no vendor safeguards, lower capability ceiling

Anthropic’s advantage is clarity: tiers map to named use cases, and Mythos-class models no longer require a bespoke partnership. The tradeoff is that you work inside Anthropic’s classifiers and policy, which will sometimes block what a self-hosted model wouldn’t.

What’s next

Watch turnaround times first. Anthropic wants to answer Defense Access applications within days. If that holds as applications pile up, Defense Access becomes the default for every serious security team. If it slips to weeks, teams will drift back to open-weight models and workarounds. Also watch how often classifiers block legitimate Red Team work. That false-positive rate will decide whether pentesters build on the program.

Second, expect knock-on effects in vulnerability disclosure. A program that surfaces 129,000 verified flaws in four months strains CVE assignment, maintainer inboxes and vendor patch cycles. Coordinated-disclosure tooling, rate-limiting norms and AI-assisted patch generation will likely form the next layer, from Anthropic or the surrounding ecosystem.

Third, watch the Specialized tier’s government review. If allied governments want equivalent review paths for their own critical infrastructure, the program will probably have to regionalize. Meanwhile, all three tiers cover “future models,” so approval now likely gives your team early access to whatever follows Mythos 5.1 without reapplying.

Frequently Asked Questions

What is the Claude Cyber Verification Program?

It’s Anthropic’s vetted-access program for security professionals. Approved organizations and researchers get Claude models, currently Opus 5.5, Sonnet 5.5 and Mythos 5.1, with fewer cyber-related restrictions, scaled by tier: Defense Access, Red Team Access and Specialized Access.

What happened to Project Glasswing?

Anthropic merged it into the Cyber Verification Program. Glasswing previously gave organizations securing critical software access to Claude Mythos. That access now runs through the unified tier structure.

Can an individual researcher apply?

Yes. Defense Access explicitly includes individual researchers with a history of reported vulnerabilities. A solid record of CVEs, advisories or bug bounty findings is your strongest evidence.

Does Red Team Access mean no restrictions?

No. It allows authorized penetration testing and red teaming only on systems you’re permitted to test, and real-time classifiers still block requests that move toward clearly harmful actions such as deploying ransomware.

Do I need a different API or model ID once approved?

Public reporting doesn’t describe a separate endpoint. Access attaches to your organization, and you use the standard Claude API. Query the models endpoint on your key to confirm which model IDs you can use.

Who qualifies for Specialized Access?

Only organizations authorized to test safety-critical systems such as power grids and telecom networks. Anthropic says it currently handles those reviews in collaboration with the U.S. government.