Fewer blocks, in exchange for the logs

Anthropic's generally available Claude models are built to refuse most offensive security work. On Tuesday the company published the terms on which it will refuse less. In a post titled "Expanding the Cyber Verification Program", it said it was merging the two routes it has used since April to give vetted defenders stronger tools, Project Glasswing and the original Cyber Verification Program (CVP), into one programme with three tiers. Each tier includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, and new models as they ship. What changes from tier to tier is how often the model says no.

The company's case rests on one sentence: "Cybersecurity is inherently dual use: the same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it." Its public models, it says, "have conservative cyber safeguards that block most cyber work." Glasswing gave a group of organisations securing critical software access to Mythos; the old CVP loosened safeguards on Opus and Sonnet for vetted teams. The new structure is meant, Anthropic says, "to give more security organizations access to the capabilities they need to protect their systems."

The bottom tier, Defense Access, covers security operations, incident response, malware reverse-engineering and vulnerability validation. Anthropic lists security teams defending their own systems, operators of critical infrastructure "of any size, such as regional hospitals or municipal utilities", smaller security firms, open-source maintainers and individual researchers with a track record of reported vulnerabilities as examples of who should qualify, and says it aims to answer applications "within a few days." Red Team Access adds authorised penetration testing against systems the customer is permitted to test. It is for organisations only, takes "a few weeks" to review, and still blocks in real time actions "that could cause physical harm or mass disruption, such as deploying ransomware." Specialized Access, with the fewest blocks, is for organisations authorised to test systems such as flight operating systems, power grids, telecom networks and interbank transfer infrastructure. "For this tier, we currently review every organization in depth in collaboration with the US government," Anthropic writes. Glasswing's existing members move into it without reapproval for current models.

The price of entry is the same at every level. "Data retention is required for organizations enrolled in the program so that we can monitor for cyber misuse," the post says. Anthropic promises a way out later this autumn through Enterprise Frontier Safeguards, which it describes as combining the privacy of zero data retention with its safeguards and which will let eligible customers keep data in cloud infrastructure they control. Until then, only organisations that already have zero-retention access to Claude Fable 5.1 or Mythos 5.1 can join on those terms. The arrangement also shapes where the programme runs: it is available on Anthropic's own platform, Google Cloud's Vertex AI and Microsoft Foundry, but on Amazon Bedrock only for customers eligible for the new safeguards, SecurityWeek noted.

Anthropic published its own test of how far the tiers differ. It ran Opus 5.5 five times through each of the ten challenges in CyScenarioBench, an evaluation of multi-stage cyber operations, with safeguards tuned to each tier. Without CVP access, every task was blocked on the first prompt. In the Defense tier, 46 of the 50 trials were blocked at some point and four succeeded. In the Red Team tier nothing was blocked and the model completed 34 of 50, which the company calls "effectively equivalent" to its 67.6 per cent success rate with no safeguards at all. On this benchmark, then, the Red Team tier blocked nothing and the Defense tier blocked nearly everything.

The justification is the Glasswing record. Anthropic says partners "uncovered at least 129,000 verified software vulnerabilities between April and July 2026," that its own open-source scanning found 5,500 more, and that more than 33,000 have been rated critical or high severity. It calls the totals a lower bound drawn from 33 partner reports and expects "the true impact to be at least five times higher." Fixing is a different matter. The Register read Anthropic's figures as showing 5,674 true-positive vulnerabilities, of which 3,014 were high severity and 1,522 critical, and only 516 patched. Anthropic says fewer than half of its partners disclosed patch numbers, often because fixes were still in progress, so "the patch rate is significantly undercounted." The Register also cited a VulnCheck researcher who found that fewer than 0.5 per cent of the 225 Anthropic-linked vulnerabilities he tracked were being exploited in the wild.

The shape of the offer is becoming familiar. Mistral said on Tuesday that until it publishes the weights of Mistral Large 4, it is giving "cybersecurity leaders, vetted partners, and state authorities" a version with "reduced moderation and expanded cyber capabilities," as we reported. Anthropic has now written down the same bargain as a standing product: identity is verified, the work is defined, a government is involved at the top, and the company watches the traffic. The difference is that Mistral's arrangement ends when the weights ship, after which anyone can run the model without asking. Anthropic's is a standing programme, with no end date announced.

For a security team the practical questions are procedural. Existing CVP members keep their settings for older models and will be "automatically evaluated" for the new ones, but administrators must assign the programme to workspaces themselves. Teams that hit blocks they think their tier should allow can file a report through a form. And teams that cannot accept retention of their data, which for incident response may include a client's logs and code, will need to wait for Enterprise Frontier Safeguards, for which Anthropic has given no date beyond "later this fall."