Anthropic Merges Glasswing and Cyber Verification Program Into Three Tiers of Reduced Claude Safeguards

Anthropic announced on Oct. 6, 2026 that it combined Project Glasswing and its earlier Cyber Verification Program (CVP) into a single tiered program, according to Dark Reading. Vetted security professionals get advanced Claude cyber capabilities with fewer safeguards. Which restrictions fall away depends on the tier, and Dark Reading reports the top tier is vetted jointly with the US government.

Help Net Security reports that all three tiers apply to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models. Most of what is public about the program, including the test numbers, comes from Anthropic’s own account. That shapes how far the safety tradeoff can be judged from outside.

Three levels of trust

The widest tier is Defense Access. Dark Reading says it covers incident response, malware reverse engineering (taking apart malicious code to see what it does) and vulnerability analysis and validation. Anthropic’s pool of eligible applicants is broad: Dark Reading lists corporate, nonprofit, university and government security teams, plus operators of critical infrastructure, smaller security firms and open-source maintainers. Individual researchers can apply too if they have a history of reported vulnerabilities.

Help Net Security reports Anthropic aims to answer these applications within a few days.

Red Team Access adds authorized penetration testing and red-teaming, meaning simulated attacks meant to expose weaknesses, Help Net Security reports. Only organizations qualify, and individual researchers are currently left out. Testing must stay on systems the organization is authorized to assess. Cyber Security News reports reviews can take several weeks, and qualifying applicants receive Defense Access while they wait.

Dark Reading reports that some real-time blocks survive even here. Claude still refuses actions that might cause physical harm or widespread disruption, for example releasing ransomware, harming physical systems or probing safety systems that carry high risk.

Specialized Access carries the fewest cyber blocks, per Help Net Security. It is meant for a small set of verified organizations cleared to test things like power grids, flight systems, telecom carriers, interbank payment infrastructure and government administrative networks. Dark Reading reports Anthropic vets each applicant alongside the US government. Help Net Security adds that current Glasswing members move in without a new approval for models they already use.

Dark Reading describes Glasswing as a vetted group of more than 40 companies with access to Claude Mythos, among them Amazon, Apple, Microsoft, Google, the Linux Foundation, JPMorganChase and Nvidia. The outlet reports Anthropic held back wider Mythos access because of dual-use potential, meaning the same skills serve attackers and defenders.

What Anthropic's benchmark shows about the tradeoff

The Hacker News reports Anthropic ran Opus 5.5 through CyScenarioBench: 10 challenges, five attempts each, 50 trials in all. With no CVP access, every one of the 50 was stopped at the first prompt.

Help Net Security reports that Defense Access changed the picture only slightly: 46 trials hit a block at some point and four got through. Red Team Access removed blocks entirely in this test, and 34 trials were completed. Cyber Security News says Anthropic describes that 34 of 50 as effectively matching the model’s rate with safeguards removed, 67.6%.

On one test, the middle tier performs like a model with no guardrails, with the physical-harm blocks Dark Reading describes sitting outside what the benchmark measures. The Hacker News and Cyber Security News both describe the numbers as Anthropic’s own evaluation, not an independent assessment.

The numbers show how much a verified tier changes outcomes across 10 scenarios. They do not describe how the model behaves in real engagements.

The case Anthropic makes for access

Anthropic says Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026. Its own open-source scanning turned up another 5,500 between April and October, the company says. Dark Reading reports that more than 33,000 of the flaws were rated critical or high severity.

Anthropic calls those totals likely low because they rest on survey responses from only some partners. The Hacker News reports the company anticipates real impact of at least five times the count. Claims Journal reports that fewer than half of partners shared patch counts, so discovery is not the same as remediation.

The Decoder reports that partners including Booz Allen and Comcast said the AI cut vulnerability detection timelines by months or years. Those are partner statements.

VulnCheck’s Patrick Garrity found that 2 of 300 vulnerabilities discovered by Anthropic or Glasswing, or 0.67%, had been exploited in the wild as of an analysis published in late September, The Hacker News reports. That is a snapshot of a growing set of findings.

Who gets trusted, and what is not public

BigGo Finance reports that Anthropic has not said how many organizations sit in each tier or what standards the US government applies when it helps vet applicants.

Separately, TechCrunch reports the US government placed export controls on Anthropic’s Mythos and Fable models in June 2026. They were later lifted: Fable 5 returned to general access July 1, and Mythos 5 came back only for vetted US organizations. TechCrunch does not link those controls to the joint vetting in the new program.

Help Net Security reports the program generally requires data retention so Anthropic can watch for misuse. Enterprise Frontier Safeguards, expected later this fall, will let eligible firms keep data in their own cloud. Until then, organizations approved for zero data retention on certain models can use CVP that way.

Arabian Post reports participants must name a security contact and use personal accounts for approved users. They must report suspected breaches or misuse within 72 hours and security incidents within 24 hours.

Per Help Net Security, access runs through the Claude Platform, Google Cloud Vertex AI and Microsoft Foundry. Amazon Bedrock access is limited to customers eligible for Enterprise Frontier Safeguards.

What practitioners say about guardrails

TechCrunch reports that offensive security researchers have criticized AI guardrails, including inside vetted programs. Complaints include inconsistent behavior, refusals, and a retreat to open-source models such as GLM run locally. Other researchers told the outlet guardrails do not touch their work because they do not use AI for exploit development.

TechCrunch notes OpenAI runs a comparable vetted program, Trusted Access for Cyber. Tying looser limits to verified identity is not unique to Anthropic.

People outside the program keep some cyber uses, Help Net Security reports. Generally available Claude models can still support code review, fixing known issues, finding flaws in code the user owns and alert triage.

What to watch

• Whether anyone outside Anthropic reproduces the CyScenarioBench results.
• Whether more partners disclose patch counts beyond the fewer-than-half level reported so far.
• Whether Anthropic publishes tier participation numbers or the US government's vetting criteria.
• Whether Enterprise Frontier Safeguards arrives this fall, as Help Net Security reports Anthropic expects.

The program sets different trust levels for different work, and Anthropic’s own test shows the middle tier matching the no-safeguards rate on one benchmark. Tier headcounts, vetting criteria and independent results have not been published, according to the reports above.