Expanding the Cyber Verification Program

What it claims

The Cyber Verification Program (CVP) is Anthropic's application-based route to reduced cyber safeguards on Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models. Generally available models, including Claude Fable 5.1, keep conservative safeguards that "block most cyber work." Those models remain usable for code review, patching known issues, finding vulnerabilities in owned source code and triaging security alerts. Anthropic says partners rated more than 33,000 of the Glasswing-era vulnerabilities critical or high severity. Its own open-source scanning added 5,500 verified vulnerabilities between April and October 2026.

How it works

Each tier has its own scope, eligibility and review time:

• Defense Access covers SOC and incident response work, malware reverse-engineering, and vulnerability analysis and validation. Eligible applicants include in-house security teams, critical infrastructure operators of any size, small security firms, open-source maintainers, and individual researchers with a record of reported vulnerabilities. Anthropic aims to reply within a few days.
• Red Team Access adds authorized penetration testing against systems the organization is authorized to test. Review takes a few weeks, and applicants get Defense Access in the meantime. The tier is for organizations only. Real-time blocks remain on ransomware deployment, damage to physical systems, and pen testing high-risk safety systems.
• Specialized Access has the fewest blocks. It is for organizations authorized to test systems such as flight operating systems, power grids, telecom networks, interbank transfers and government administrative networks. Each organization is reviewed in depth with the US government. Glasswing members move into this tier without reapproval for current models.

Evidence

Anthropic tested Claude Opus 5.5 on CyScenarioBench, an evaluation of multi-stage cyber operations. The run used 10 challenges with 5 attempts each per tier. Without CVP, every task was blocked on the first prompt. Defense Access blocked 46 of 50 trials, and the other 4 succeeded. Red Team Access had no blocks and completed 34 of 50. Anthropic calls this equivalent to the 67.6% unsafeguarded success rate, which it treats as representative of Specialized Access. Specialized Access was not tested separately. The 129,000-vulnerability figure comes from survey data from a subset of Glasswing partners. Anthropic estimates the true number is at least five times higher, which is a projection, not a count.

How to use it

Applicants are verified and must provide proof of the security controls their tier requires. Existing CVP members keep their settings for older models and are automatically evaluated for the new ones. Admins must assign CVP access to specific workspaces. CVP runs on the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. On Amazon Bedrock, it is available only to customers eligible for Enterprise Frontier Safeguards (EFS). Blocks on work a tier should allow can be reported through a form.

Limits

Enrolled organizations must allow data retention so that Anthropic can monitor for misuse. There is one exception: organizations that already have zero data retention on Claude Fable 5.1 or Mythos 5.1 can use CVP with zero retention. EFS, due "later this fall," will let eligible organizations store data in cloud infrastructure they control. Defense Access still blocks most interactive offensive scenarios. Anthropic says it will keep tuning its tier-based classifiers, so blocking behavior may change. The per-tier security control requirements are in a table and the Help Center, and that text is not in the fetched page.