Anthropic's expanded Cyber Verification Program changes which cyber operations approved users can perform with Claude. It covers Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models, offering three access levels rather than one uniformly restricted experience. The important change is not a larger usage quota: the company's own benchmark shows that removing selected safeguards materially changes what the model completes.
The program is a governance tradeoff. Strong filters can stop attackers and also block defenders rehearsing attacks on their own systems. Anthropic is moving some of that boundary from request-level restrictions to verified identities, organizational controls, target authorization, monitoring and, for the most sensitive cases, U.S. government review. Whether that substitute remains reliable at scale is not established by the announcement.
Three tiers grant different capabilities and obligations
Defense Access supports incident response, security operations, malware analysis, vulnerability validation and defensive research. Eligible applicants include businesses, universities, nonprofits, government bodies, open-source maintainers and individual researchers with credible disclosure histories. Regional hospitals and municipal utilities are explicitly included; the company aims to respond to many applications within several days.
Red Team Access permits authorized penetration testing and adversarial exercises against owned systems or targets the organization has permission to test. Internal teams, consultancies and government groups face additional vetting and security controls. Reviews are expected to take several weeks, with Defense Access available while the application proceeds.
The red-team tier still restricts activities linked to physical harm or widespread disruption, including ransomware deployment, damage to physical systems and testing high-risk safety systems. It is not unrestricted authority over any target.
Specialized Access removes more cyber restrictions for organizations authorized to test systems whose failure could endanger lives or major markets. Examples include flight operations, grids, telecommunications, interbank transfers and government administration. Anthropic says it reviews every participating organization in depth with the U.S. government. Existing Glasswing members move into this tier without new approval for current models.
That structure requires more than a verified email address. It links a person to an institution, an access level, authority over targets and technical safeguards. A legitimate organization can still have a compromised account, an employee exceeding permission or a former contractor whose access was not revoked.
Benchmark blocks fell, while completion approached the unrestricted result
Anthropic evaluated Opus 5.5 on CyScenarioBench with five attempts on each of ten challenges at every level: fifty trials per tier. Without program access, every task was blocked at the first prompt.
Defense Access still stopped 46 of fifty trials before completion, with four successes. Red Team Access had no safeguard blocks and completed 34 of fifty, or 68%. The company compared that with 67.6% without safeguards.
These results show a real behavioral difference. They do not establish performance across all industrial equipment, unfamiliar software or attacks involving social engineering. Nor do they demonstrate that institutional verification prevents misuse. The benchmark tests selected task completion, not the entire access-control operation.
A safety classifier is separate from the underlying model and can interrupt behavior it judges prohibited. Similar technical requests can be defensive or malicious depending on authority. Verification supplies some of that missing context before a session; it does not make context permanently correct or every generated action safe.
Discovery totals do not supply a patch rate
Anthropic says Glasswing partners found at least 129,000 verified vulnerabilities from April through July 2026. Separate open-source scanning found another 5,500 from April through October. More than 33,000 findings were rated critical or high severity, and the company says reports from only 33 partners likely understate the program's reach.
Methods for verification and classification differed among participants. Fewer than half disclosed patch numbers, often because remediation was continuing. Those incomplete remediation figures prevents treating more than 134,000 verified findings as more than 134,000 repaired exposures.
A useful fix requires reproducing the issue, assessing affected systems, coordinating disclosure, testing a patch and deploying it. Anthropic has acknowledged that verification, disclosure and repair have become bigger bottlenecks than initial discovery. More scanning can improve coverage while also overwhelming maintainers or lengthening a triage queue.
Infrastructure operators need direct access because they understand their own environments and can authorize realistic tests. That advantage only improves defense when they also have the people and authority to deploy repairs. A severe finding sitting unpatched for months is not made harmless by having been discovered privately.
Adaptation makes the capability useful and risky
Anthropic's Pacific Northwest National Laboratory collaboration used an agent scaffold—tools and instructions permitting controlled actions—against a cyber-physical model of a water treatment facility. The company says an attack was reconstructed in three hours rather than several weeks.
That test used the older Sonnet 4, not one of the newly covered models. In one run, a prepared Windows privilege-control bypass failed and the model selected another known method. It illustrates adaptation in a simulated environment, not permission to attack a live utility or proof of safety there.
The same recovery from failed steps can help both defenders and attackers. Basic code review and patch assistance remain generally available; interactive, multistage work resembles intrusion closely enough that the program verifies operator and target rather than trusting prompt wording alone.
Monitoring creates a separate data-governance tradeoff
Anthropic generally requires data retention to detect misuse. Existing Fable 5.1 or Mythos 5.1 users with zero-data-retention arrangements can temporarily retain those protections while joining. That is a limited exception, not a general promise of zero retention across the program.
The planned Enterprise Frontier Safeguards would combine misuse controls with storage managed in participants' own cloud environments. It is not already a universally available solution. Sensitive source code and incident evidence still require an exact account of current retention, access and monitoring conditions.
Customer-managed storage could improve privacy while complicating consistent oversight if controls differ among environments. Monitoring may also detect an abuse only after a useful attack path has been generated. Identity review therefore needs target isolation, constrained actions, logging, revocation and recovery procedures at the participating organization.
Government participation improves vetting and raises oversight questions
Earlier classified Mythos testing produced different public descriptions. An official told the Associated Press that weaknesses were found within hours and stressed that finding did not mean exploitation. Senator Mark Warner described access to almost all tested environments in hours, attributing that account to the NSA and Cyber Command leadership. The NSA and Anthropic declined to confirm details. These accounts should not be flattened into one proven penetration result.
The broader context includes June national-security review of frontier releases, temporary withdrawal of Fable 5 and Mythos 5 after a foreign-national-access directive, and later limited approval of Mythos. OpenAI's GPT-5.6 Sol faced similar review. Representative Lori Trahan criticized company-by-company political decisions without clear law, process or oversight.
Government participation can help assess sensitive targets and legal authority. It also concentrates access decisions in criteria not fully public, with implications for a global software ecosystem. Glasswing previously included partners in more than fifteen countries. Consistent standards, appeals and auditable revocation matter when defensive capability depends on institutional and national relationships.
The meaningful next evidence is approval quality, misuse detection and remediation—not merely another discovery total. Aggregate review times and revocations, repaired vulnerabilities and deployment delays, and the response to a serious access failure would test the program's premise. Anthropic has shown that tiers change Claude's behavior. It has not yet shown that expanding verified access reliably turns that increased capability into safer infrastructure.