Anthropic expands restricted access to cyber-capable models through Project Glasswing

Anthropic on Oct. 6, 2026, announced an expanded Cyber Verification Program that integrates its earlier cyber-access program with Project Glasswing, widening restricted access to powerful models for verified security organizations without making those capabilities generally available. Anthropic announcement | Reuters report

What changed on Oct. 6

Integration, not a new public launch

Project Glasswing began on April 7, 2026, as a controlled effort aimed at helping organizations secure critical software. Anthropic described Glasswing and the earlier CVP as two programs it had operated for roughly six months before folding them into one expanded offering. Glasswing gave a group of organizations working on the most critical software access to Claude Mythos, while the earlier CVP gave vetted security teams access to Claude Opus and Claude Sonnet with reduced safeguards. Anthropic’s account of the two programs | Reuters background

The distinction matters. Oct. 6 was an expansion and integration of restricted programs, not the standalone launch of Glasswing and not a public opening of cyber-capable models. Interested organizations must apply, and Anthropic says it will verify applicants and request evidence of the security controls required for the relevant tier. Existing CVP members keep their settings for earlier models while Anthropic evaluates their access to the updated model lineup. Application and verification details

The model set remains conditional

Anthropic says all three tiers can include Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models. That does not mean every applicant receives every model or the same level of capability. Access is conditioned on verification, tier-specific controls and the organization’s authorized work. The company describes the program as making advanced cyber capabilities and reduced blocking classifiers available to qualifying security professionals, rather than removing safeguards across its products. Program scope and models

Anthropic also says data retention is required for enrolled organizations so it can monitor for cyber misuse, subject to the privacy arrangements described in its announcement. The company identifies Claude Platform, Google Cloud’s Vertex AI and Microsoft Foundry as CVP channels, with Amazon Bedrock availability limited to customers eligible for Enterprise Frontier Safeguards. Those distribution details reinforce that this is an enterprise access scheme, not a consumer-facing release. Platform and data-retention terms

How the three tiers work

Defense Access is the broadest defensive lane

Defense Access is intended for defensive work such as security-operations-center activity, incident response, malware reverse-engineering, and analyzing or validating vulnerabilities. Anthropic lists security teams at companies, nonprofits, universities and government bodies; critical-infrastructure operators such as hospitals and municipal utilities; smaller security firms; open-source maintainers; and individual researchers with a record of reported vulnerabilities as examples of potential applicants. Defense Access description

The tier reflects a basic policy judgment: defenders often need to inspect suspicious code, reproduce weaknesses and develop fixes, while the same model capabilities could help an attacker. Anthropic says many organizations doing defensive cybersecurity work are expected to qualify and that it aims to respond to applications within a few days. That is an expectation about review timing, not a promise of approval or unrestricted model use. Anthropic’s eligibility and timing statements

Red Team Access adds authorized adversarial testing

Red Team Access adds authorized penetration testing and red-teaming to the defensive uses covered above. It is available to organizations such as in-house red teams, government red teams, and security and penetration-testing firms. The authorization boundary is central: users may test only systems they are authorized to test, including information-technology systems in critical industries. Individuals are not eligible for this tier under the terms Anthropic published on Oct. 6. Red Team Access controls

Even at this level, Anthropic says real-time blocks remain on actions that could cause physical harm or mass disruption, including deploying ransomware, damaging physical systems or penetration testing high-risk safety systems. The company expects applications to take a few weeks to review and says qualifying organizations are placed in Defense Access while their Red Team applications are considered. The staged review is another indication that reduced blocking is not equivalent to unrestricted offensive capability. Review process and prohibited-risk examples

Specialized Access is the narrowest and most sensitive lane

Specialized Access has the fewest cyber blocks and is reserved for a limited set of verified organizations authorized to test systems whose failure could affect lives or disrupt markets. Anthropic gives flight-operating systems, power grids, telecommunications networks, interbank-transfer infrastructure and government administrative networks as examples. The category is therefore defined not just by technical sophistication but by the consequences of the systems under test. Specialized Access description

Anthropic says it currently reviews every Specialized organization in depth in collaboration with the U.S. government. Existing Project Glasswing members transition into this tier and do not need reapproval for current models. That transition preserves a controlled pathway for the original partners while setting a high bar for new organizations seeking the fewest cyber blocks. Specialized review and Glasswing transition | Reuters account of government collaboration

What Glasswing has reported

Large vulnerability totals, with narrow definitions

Anthropic says Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026. Separately, Anthropic says its own open-source scanning efforts found an additional 5,500 verified software vulnerabilities between April and October. More than 33,000 of the verified vulnerabilities had so far been rated critical or high severity. Reuters reported the same figures while describing the partners’ results as more than 100,000 vulnerabilities. Anthropic’s reported totals | Reuters report

These are reported findings, not a census of all software vulnerabilities and not an audited measure of the global effect of Claude. Anthropic says the partner results are based on partial data from 33 partner reports. Organizations used different approaches to triage their findings, and fewer than half disclosed how many vulnerabilities had been patched, often because remediation was still in progress. The published figures therefore say more about verified discoveries reported through the program than about completed fixes or total risk removed. Data limitations in Anthropic’s announcement

What the numbers cannot establish

The figures do not by themselves establish that every discovery was caused solely by a model, that the vulnerabilities would otherwise have remained undiscovered, or that the results can be generalized to all security teams. They also do not provide a complete patch-rate picture. Reuters relayed the company’s figures but did not independently audit them or present them as a census. Those limits are important when a large number is used to support a claim about defensive advantage. Reuters reporting | Anthropic’s qualification of the data

Anthropic estimates that the true impact may be at least five times higher. That is the company’s estimate, not an independently verified result and not a fact established by the available reports. It should be read alongside the company’s own description of the dataset as partial, non-uniform and incomplete on patching. Anthropic’s estimate and caveats

Why controls and uncertainty matter

Cyber capability is explicitly dual use

Anthropic frames the policy problem as dual use: the capabilities that help a security team find and fix a weakness can also help a malicious actor exploit it. Its generally available models retain conservative cyber safeguards intended to limit harmful activity, even as the company works to reduce false positives affecting secure coding. The restricted CVP tiers are an attempt to separate authorized defensive and testing work from broader, less accountable access. Anthropic on dual use and general safeguards

That separation is imperfect by design. Defense Access still gives approved users more room to investigate vulnerabilities, and Red Team Access removes more blocks for authorized adversarial testing. Specialized Access goes furthest because its users are meant to test high-consequence systems. The corresponding risk is that a credentialed user, compromised environment or mistaken authorization could turn legitimate access into a pathway for harm. The published announcement does not quantify that residual risk, so it should not be treated as resolved by tiering alone.

Verification is a control, not proof of safety

Verification, evidence of security controls, workspace assignment and monitoring for cyber misuse create accountability around access. Anthropic’s statement that Specialized organizations are reviewed in depth with U.S. government collaboration adds an additional oversight layer for the most sensitive category. None of those measures is described as a guarantee that a model response, user or target environment will always be safe. They are restrictions intended to make access more deliberate and traceable. Anthropic’s verification and monitoring terms

Responsible disclosure and remediation remain the practical test of whether discovery becomes protection. The available data does not show a complete patched count, and fewer than half of partners disclosed such numbers. That gap means a vulnerability can be counted as verified without the public record showing whether, when or how it was fixed. A defender-focused program therefore needs both authorized testing and disciplined handling of findings, while readers should resist equating discovery totals with completed security improvements.

Safeguards are being tested, not declared final

Anthropic reports a CyScenarioBench test of Claude Opus 5.5 under different CVP settings. Without CVP access, every task was blocked on the first prompt. In Defense Access, 46 of 50 trials were blocked at some point and four succeeded. In Red Team Access, no blocks occurred and 34 of 50 tasks were completed, a rate Anthropic says was equivalent to the model’s result with no safeguards in that evaluation, which it uses as representative of Specialized Access. These are the company’s evaluation results on five attempts across each of 10 challenges; they are not a guarantee about real-world performance. Anthropic’s CyScenarioBench results

What the expansion does and does not mean

It expands the circle of vetted defenders

The practical change is a broader, tiered route for organizations that can show a legitimate cybersecurity need and the controls required for their work. That could give more defenders access to capabilities that Anthropic says helped Glasswing partners find weaknesses in critical software. It also makes the distinctions among defensive analysis, authorized red-teaming and safety-critical testing more explicit. Anthropic’s description of the expanded offering

The expansion is not an invitation for anyone to use Claude Mythos or the other named models for offensive experimentation. Applicants are verified, access is tied to a tier, and Specialized Access is limited to a small group of organizations. The models’ availability through listed enterprise channels does not change that qualification requirement. Application requirements and channels

The unresolved question is scale with accountability

Anthropic is trying to scale an advantage for defenders while preserving restrictions around systems that could affect physical safety, public services or markets. The vulnerability figures offer a reason to pursue that goal, but their partial sourcing, inconsistent triage and incomplete patch reporting leave major questions about durability and net risk. Future reporting would need to clarify who receives access, how often safeguards block or permit activity, how findings are disclosed and how many are fixed.

For now, the clearest fact is narrower: Anthropic has expanded a controlled verification program, not released a general-purpose cyber tool. The success of Project Glasswing’s next phase will depend on whether restricted access produces defensible security gains without creating equally difficult pathways to misuse.

References

1. Anthropic, “Expanding the Cyber Verification Program,” Oct. 6, 2026.
2. Reuters, “Anthropic opens its most powerful AI models to more security teams,” Oct. 6, 2026.

Conclusion

Anthropic’s expanded CVP offers verified defenders a more graduated route to cyber-capable models, with the fewest restrictions reserved for organizations testing systems where failure could endanger lives or disrupt markets. Its reported vulnerability gains are significant but incomplete and unaudited. The program’s central wager is that controlled access, authorization and oversight can give defenders an advantage without making dual-use capability broadly available.