American company Anthropic is making its most powerful artificial intelligence models available to a much broader range of cybersecurity experts. On Tuesday, the company unveiled a revamped Cyber Verification Program, merging its two existing pathways to advanced cybersecurity capabilities. Verified security teams will gain access to the Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 models, as well as all future versions. These models will have more relaxed safeguards than versions for ordinary users. In cooperation with the US government, the most thoroughly vetted experts will even be allowed to try to breach the protections of systems underpinning power grids, banks, or air traffic.
Cybersecurity, however, comes with one fundamental catch. The same capabilities that allow a security team to find and fix a flaw in a system can be exploited by an attacker. Anthropic has therefore equipped the publicly available Opus 5.5, Fable 5.1, and Sonnet 5.5 models with strict safety filters that immediately block most cybersecurity-related tasks. In doing so, it aims to make attackers’ work as difficult as possible, although it acknowledges that the filters occasionally intervene where they do not need to, such as when writing secure code.
Defenders need the best tools, however, so over the past six months the company has been opening the door to them in two ways. In April, Project Glasswing made the Mythos model available to selected US government agencies, financial institutions, and major software manufacturers. Bloomberg described the release of this model as a breakthrough because it can partially automate the work of experienced hackers. The second pathway was the CVP itself, which relaxed restrictions on the Opus and Sonnet models for vetted security teams. Anthropic is now combining both pathways into a single offering that will give all program members access to the Mythos models for specific security tasks.
Three tiers based on users’ needs
The broadest tier is called Defense Access and is focused purely on defense. It covers the work of security operations centers, incident response, malware analysis, and vulnerability verification. Security teams from companies, nonprofit organizations, universities, and government agencies that protect their own systems are eligible to participate. Operators of critical infrastructure are also included regardless of size, such as regional hospitals or municipal water utilities. The tier is also open to smaller security companies, open-source software maintainers, and individual researchers with a history of reporting vulnerabilities. Anthropic expects a large share of applicants to qualify for this tier and aims to respond to applications within a few days.
One tier higher is Red Team Access. In addition to defensive work, it permits authorized penetration testing—controlled attacks in which experts look for weaknesses before someone else finds them. This tier is intended for internal and government teams specializing in simulated attacks, as well as companies offering penetration testing as a service. Experts may test only approved systems, including those in critical sectors. Even here, however, real-time filters will stop actions that could cause physical harm or widespread outages. The model will therefore refuse to deploy ransomware, damage physical equipment, or test high-risk systems. Assessing an application will take several weeks, and organizations will receive Defense Access in the meantime. Individuals are not yet eligible for this tier.
Specialized Access offers the fewest restrictions. It is reserved for a small group of verified organizations authorized to test security systems that could affect human lives or markets. These include aviation systems, energy grids, telecommunications, infrastructure for interbank transfers, and government administrative networks. Anthropic thoroughly vets each such organization in cooperation with the US government. Existing Project Glasswing members will automatically move to this tier and will not have to reapply for approval for current models.
Meanwhile, people can continue using the publicly available models for code review, fixing known bugs, finding vulnerabilities in their own source code, or sorting security alerts. Organizations in the program must accept that Anthropic will retain their data to monitor for potential misuse. The company plans to launch Enterprise Frontier Safeguards later this fall, combining privacy protections with security safeguards and allowing organizations to store data in their own cloud.
Testing showed where the filters take effect
To verify that the setup works, Anthropic tested the Claude Opus 5.5 model using CyScenarioBench. This test determines whether a model can plan and carry out a multi-step cyber operation under realistic conditions. The model attempted each of ten tasks five times at every access tier.
Without the CVP, the filters blocked every task immediately after the first prompt. At the Defense Access tier, 46 of 50 attempts were blocked, with only four succeeding. For penetration testers, by contrast, the model encountered no blocks and successfully completed 34 of 50 tasks. This corresponds to roughly the same 68 percent success rate the model achieves with no safety filters at the highest access tier. The company concludes that it can safely make advanced capabilities available to a much broader range of defenders and plans to gradually fine-tune the filters for each tier.
Tens of thousands of flaws that would otherwise have remained hidden
The results of Project Glasswing demonstrate the practical difference these models make. With the help of the Mythos models, partners identified nearly 130,000 verified software vulnerabilities between April and July. While auditing open-source software, Anthropic itself found roughly another five and a half thousand flaws between April and October. More than 33,000 of them were rated high or critical in severity.
The company notes that these figures are based only on questionnaires completed by some partners and estimates the actual impact to be at least five times greater. Organizations also categorized flaws in different ways, and fewer than half reported how many vulnerabilities they had already fixed, often because they were still working on the fixes. Several Anthropic partners confirmed that finding the same number of flaws without the Mythos models would have taken them months longer, and in some cases even years.
Powerful tools, growing concerns
The expansion comes at a time of growing unease about artificial intelligence capabilities in cybersecurity. According to Bloomberg, recent months have seen a series of incidents in which models from Anthropic and OpenAI inadvertently breached the systems of governments, companies, and nonprofit organizations. JPMorgan Chase CEO Jamie Dimon said on Bloomberg Television on Tuesday that Mythos had increased global cyber risks tenfold.
Washington is also entering the fray. In August, the US government announced that it would work with private companies on cyberattacks abroad. This expanded the range of security operations that had previously been conducted mainly by government agencies. Anthropic’s close cooperation with the government in vetting organizations for the highest access tier is therefore unsurprising.
Interested parties can apply through the company’s portal. Anthropic will verify all applicants and require them to document the security measures required by the relevant tier. Existing program members will retain their settings for older models, while the company itself will decide on their access to Opus 5.5, Sonnet 5.5, and Mythos 5.1. The program runs on the Claude platform, Google’s Vertex AI service, and Microsoft Foundry. Amazon Bedrock customers can access it only if they meet the requirements for Enterprise Frontier Safeguards. Anyone who encounters a block while performing work that their tier should permit can report it to the company using a dedicated form.
Sources: anthropic.com, reuters.com and finance.yahoo.com
