NIVΞCTOR
NewsSupport

The counter has not started

Artificial intelligence · Article

How Anthropic's Cyber Verification Program Tests and Limits AI Safety Risks

Published:

Offices of Slack Technologies at 500 Howard Street in San Francisco (at the center with neighboring buildings, seen from the back across Howard Street)
Image credit: HaeB · CC BY-SA 4.0 · Wikimedia Commons

In brief

Anthropic's Cyber Verification Program (CVP) is a tiered vetting system that lets approved cybersecurity professionals use Claude models with fewer automated safety restrictions for defensive and authorized offensive security work. Applicants are sorted into three access levels, and even the least restricted tier keeps real-time blocks on actions that could cause physical harm or mass disruption.

On October 6, 2026, Anthropic expanded its Cyber Verification Program, a system that decides how much of a Claude model's built-in cybersecurity restrictions a given user is allowed to bypass. The expansion folds an earlier initiative, Project Glasswing, into a single three-tier structure covering defensive security work, authorized penetration testing, and testing of safety-critical infrastructure.

Why Claude models block cybersecurity tasks in the first place

According to Anthropic, its publicly available models run conservative automated classifiers that block most requests resembling offensive cyber activity, such as writing exploit code or probing live systems, because the same techniques used to defend a network can also be used to attack one. This dual-use problem means a model cannot easily tell a penetration tester working under contract from an attacker without additional context about who is asking.

Three tiers of verified access

The CVP resolves that ambiguity by verifying who the user is and what they are authorized to do, then adjusting how many of those blocks apply. Anthropic and independent coverage from The Hacker News, Help Net Security and SiliconANGLE describe the same three tiers.

Anthropic Cyber Verification Program: access tiers
TierWho can applyReview timeWhat changes
Defense AccessCorporate security teams, nonprofits, universities, government bodies, critical infrastructure operators, smaller security firms, open-source maintainers, individual researchers with a vulnerability disclosure recordA few daysAllows incident response, malware analysis and vulnerability validation
Red Team AccessIn-house and government red teams, penetration-testing firms (organizations only, not individuals)Several weeksAdds authorized penetration testing and simulated attacks; real-time blocks on actions like ransomware deployment remain
Specialized AccessVerified organizations testing flight systems, power grids, telecom networks or financial infrastructureReviewed jointly with the U.S. governmentFewest cyber-related blocks, for safety-critical system testing

Models covered by the program include Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future releases, per Anthropic's announcement.

How Anthropic measured whether loosening the blocks was safe

Anthropic tested the tiers against an internal benchmark called CyScenarioBench before expanding access, according to Help Net Security and SiliconANGLE. Without any CVP access, all 50 benchmark trials were blocked. Under Defense Access, 4 of 50 tasks succeeded, meaning the classifier still stopped 46. Under Red Team Access, 34 of 50 tasks completed without any block. The Hacker News reported the same Defense Access figure from the opposite angle: 46 of 50 tasks were blocked.

Even at the least restricted tiers, Anthropic says automated classifiers that stop actions causing physical harm or mass disruption stay active, and enrolled organizations must agree to data retention so Anthropic can monitor for misuse. A zero-data-retention option, called Enterprise Frontier Safeguards, is scheduled to launch in fall 2026 for customers who want to keep that monitoring data inside their own cloud infrastructure instead.

Project Glasswing: the vulnerability-finding track record behind the program

The CVP's Specialized Access tier absorbs Project Glasswing, an earlier Anthropic initiative focused on securing critical software. Anthropic reports that Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026, with Anthropic's own open-source scanning adding roughly 5,500 more through October. More than 33,000 of the combined total were rated critical or high severity. SiliconANGLE's reporting adds that Anthropic believes the real-world impact is likely about five times higher than the verified count, based on incomplete disclosures from partner organizations.

These evaluations give us confidence that we can make advanced cyber capabilities safely available to a broader set of defenders.

— Anthropic, in its October 6, 2026 announcement

What stays restricted for everyone

Anthropic's announcement notes that generally available Claude models, outside the CVP, remain suitable for narrower security tasks such as code review, patching known vulnerabilities, finding flaws in code an organization already owns, and triaging security alerts. Individual researchers are excluded from Red Team Access entirely, and Specialized Access requires government-involved vetting, reflecting a graduated approach where the highest-risk capabilities require the strongest identity and authorization checks.

Questions

What is Anthropic's Cyber Verification Program?
It is a vetting system that lets approved cybersecurity professionals use Claude models with reduced automated safety restrictions for defensive work, authorized penetration testing, or testing of safety-critical infrastructure, depending on which of three tiers they qualify for.
Who can apply for the program?
Defense Access is open to corporate security teams, nonprofits, universities, government bodies, critical infrastructure operators and individual researchers with a vulnerability disclosure record. Red Team Access is limited to organizations such as in-house or government red teams and penetration-testing firms. Specialized Access is reserved for verified organizations testing systems like power grids or flight systems, reviewed with U.S. government involvement.
Does verified access remove all of Claude's safety restrictions?
No. Anthropic states that real-time classifiers blocking actions that could cause physical harm or mass disruption, such as ransomware deployment, remain active even at the Red Team Access tier.
What is Project Glasswing?
Project Glasswing was an earlier Anthropic initiative focused on finding vulnerabilities in critical software; it has now been absorbed into the Cyber Verification Program's Specialized Access tier. Its partners found at least 129,000 verified vulnerabilities between April and July 2026, Anthropic says.
How did Anthropic test whether the reduced restrictions were safe?
Anthropic ran the tiers against an internal benchmark called CyScenarioBench. Without CVP access, all 50 test trials were blocked; under Defense Access, 46 of 50 were still blocked; under Red Team Access, 34 of 50 completed without any block, according to reporting from Help Net Security, SiliconANGLE and The Hacker News.

Sources

  1. Anthropic — Cyber Verification Program announcement
  2. The Hacker News — Anthropic Expands Claude Access for Security Researchers
  3. Help Net Security — Anthropic loosens Claude's cyber restrictions for verified defenders
  4. SiliconANGLE — Anthropic folds Project Glasswing into an expanded three-tier Cyber Verification Program

This piece was prepared with artificial intelligence and passed an automated source check before publication. If you see an error, ask for a correction. Request a correction or reply · How we make this

Related