Anthropic Introduces 3-Tier Cyber Verification Program for AI Access

What it is

Anthropic's merged Cyber Verification Program (CVP + Project Glasswing) covering Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1, across three named access tiers: Defense Access, Red Team Access, and Specialized Access.

How it works

flowchart TD
    A[Applicant] --> B{Who are they?}
    B -->|Security teams, CI operators,\nsmall firms, OSS maintainers,\nvetted researchers| C[Defense Access]
    B -->|Organizations only,\nauthorized pentesters| D[Red Team Access]
    B -->|Gov-vetted, safety-critical\nsystem operators| E[Specialized Access]
    D -->|real-time block| F[Physical harm / mass disruption\ne.g. ransomware deployment]
    C --> G[Approval: few days]
    D --> H[Approval: few weeks;\nDefense Access granted while pending]
    E --> I[Vetted with US government;\nexisting Glasswing members moved here]

Default (non-verified) use of these models blocks most cyber work by design. Each tier removes progressively more of those safeguards: Defense Access covers SOC/incident response, malware reverse engineering, and vulnerability analysis/validation; Red Team Access adds authorized penetration testing and red teaming limited to systems the org is permitted to test (ransomware deployment and other physical-harm/mass-disruption actions remain blocked in real time even at this tier); Specialized Access has the fewest cyber blocks and is reserved for a small number of organizations testing safety-critical systems (power grids, flight systems, telecom, interbank transfer infrastructure).

Preconditions / Affected

• Individual researchers are eligible only for Defense Access, not Red Team Access.
• All tiers require accepting data retention so Anthropic can monitor for misuse — zero-data-retention is not currently compatible with the new tiers, except that orgs with existing ZDR access to Fable 5.1 or Mythos 5.1 can still use CVP under ZDR until Enterprise Frontier Safeguards ships this fall.
• Available on Claude Platform, Google Vertex AI, and Microsoft Foundry; on Amazon Bedrock, CVP is restricted to customers eligible for Enterprise Frontier Safeguards.
• Existing CVP members retain current settings for prior models and are auto-evaluated for the new ones.

What to do

Engineers whose org does cyber defense, pentesting, or critical-infrastructure security work and wants fuller model capability should apply to the matching tier now; Defense Access applications get a response in days, Red Team Access in weeks (with interim Defense Access granted). Teams needing zero data retention should check whether they currently qualify under the Fable 5.1/Mythos 5.1 ZDR exception, or wait for Enterprise Frontier Safeguards this fall if they need customer-controlled cloud storage.

Caveats

The scale figures (129,000 verified vulnerabilities from Glasswing partners April–July, 5,500 more from Anthropic's own open-source scanning April–October, 33,000+ critical/high severity) come from only a subset of program participants; Anthropic states the true impact is likely at least five times higher but does not substantiate that multiplier.