Glasswing and the CVP become one integrated offering
On October 6, 2026, Anthropic announced that Project Glasswing and its Cyber Verification Program (CVP) were being brought together in an expanded offering for access to cybersecurity capabilities. Glasswing had given organizations protecting critical software access to Claude Mythos Preview. The CVP, meanwhile, provided verified security teams with access to capabilities with fewer blocking restrictions on Claude models.
The integrated offering has three tiers: Defense Access, Red Team Access, and Specialized Access. Each covers a different scope of work and has its own verification requirements and safeguards. Access to more advanced capabilities does not amount to authorization to test any system: permission depends on the work the team is authorized to perform.
Defense is intended for defensive work; Red Team adds authorized penetration testing and adversarial exercises; Specialized is reserved for a limited group of verified organizations that can test systems whose security affects people or critical infrastructure. Existing Project Glasswing members transition to Specialized for current models without needing renewed approval for those models.
The three Cyber Verification Program tiers
| Tier | Scope described | Important limitation |
|---|---|---|
| Defense Access | Defensive work, such as security operations, incident response, and vulnerability analysis. | Access remains subject to verification and safeguards; it does not authorize testing systems owned by others. |
| Red Team Access | Adds penetration testing and adversarial exercises to defensive uses. | Testing must be conducted on authorized systems; blocks remain in place for high-risk actions. |
| Specialized Access | Authorized testing of high-risk systems, such as power grids or telecommunications infrastructure. | Reserved for a limited set of verified organizations and requires more in-depth review. |
What changes for security teams
The practical change is an access path tailored to the type of work. Defense covers security operations center work, incident response, malware reverse engineering, and vulnerability analysis or validation. Red Team extends that scope to authorized testing while retaining blocks on actions that could cause physical harm or mass disruption. Specialized requires more in-depth review of organizations and higher-risk activities.
Access to capabilities does not remove the need for authorization to test the systems involved. A penetration test fits Red Team only when the team has permission to assess the specific targets; access to the model does not replace that authorization. In Specialized, the additional review reflects the possibility that certain tests could affect systems people rely on for safety or the continuity of critical services.
The program’s terms should also be distinguished from general Claude use for code review, fixing known issues, finding vulnerabilities in owned code, or triaging security alerts. An organization should choose the tier that fits the work it is authorized to perform and check the conditions attached to its account, security controls, and data-handling obligations. A technical capability is not, by itself, operational permission.
How to choose a tier based on the work
- 01Determine whether the work is limited to defending systems the organization owns or maintains.
- 02If the work includes adversarial testing, confirm that the team has explicit authorization to assess those systems.
- 03If testing could affect life-safety systems or critical infrastructure, check whether Specialized Access is required.
- 04Review verification requirements, account safeguards, and data-handling terms before starting.
Models and access tied to authorized work
Anthropic lists Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 among the models in the offering. This does not mean that every capability is available to every organization or that access is public and unrestricted. Availability depends on verification, the tier granted, and the conditions that apply to the account.
Defense is intended for teams at companies, nonprofits, universities, and government bodies that defend systems they own or maintain. It may also include critical infrastructure operators, smaller security firms, open-source maintainers, and individual researchers with a track record of reporting vulnerabilities. Anthropic says it expects to respond to many applications at this tier within a few days.
Red Team is currently available to organizations, not individual researchers. Eligible applicants may include in-house red teams, government red teams, and security or penetration-testing firms. Members may conduct adversarial testing only on systems they are authorized to assess. Specialized is for verified organizations that can test high-risk systems; Anthropic says it reviews each organization in collaboration with the U.S. government.
The transition of existing Project Glasswing members to Specialized applies to current models. It does not imply automatic approval for any future model or any type of activity. Authorization should be understood within the scope and conditions granted to each organization under the program.
Safeguards, data, and reported results
Advanced cybersecurity capabilities raise a dual-use problem: the same analysis can help fix a vulnerability or facilitate an intrusion. The tiers therefore combine participant verification, use restrictions, and specific safeguards. Red Team retains blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems, or testing high-risk safety systems.
Anthropic requires data retention for organizations enrolled in the program so it can monitor for possible misuse. The company describes exceptions for certain existing zero-data-retention access and presents Enterprise Frontier Safeguards as a planned solution combining zero data retention with security controls. That description does not guarantee that the solution is available to every organization. Before transmitting sensitive data, each team should confirm the current conditions for its account and tier.
Anthropic says Project Glasswing partners identified at least 129,000 verified software vulnerabilities between April and July 2026. The company also attributes another 5,500 verified vulnerabilities to its own open-source scanning efforts between April and October 2026. It says more than 33,000 of those vulnerabilities had been rated critical or high severity. These figures are reported by Anthropic, rather than being an independent measurement of the program’s results.
Anthropic cautions that the partners’ figure is based on partial reports from 33 organizations and that fewer than half of partners reported how many vulnerabilities they had fixed. The company also says differences in triage processes and delays in completing some fixes limit how the results can be interpreted. The number of vulnerabilities identified therefore does not equal the number fixed, publicly disclosed, or resolved by each organization, and is not, by itself, a measure of the final effect on security.
How a security team can assess its fit for the program
Start with the work the team is authorized to perform. Defending its own systems, conducting a red-team exercise, and testing a critical system involve different scopes and safeguards. Separating these cases helps teams choose the relevant tier without assuming that model access enables any security task.
A decision to use the program should also account for the models and capabilities available to the account, the scope of the authorizations, the data that will be transmitted, and the team’s operational safeguards. Findings should be checked against the actual system and the procedures for reporting and fixing vulnerabilities. Detecting a flaw does not mean a patch has been applied or that the risk has disappeared.
The integrated offering has three tiers and keeps access conditional. A team can assess its usefulness with representative, authorized tasks, distinguishing between the capabilities available, the results obtained, and the measures actually implemented. Aggregate figures and features announced for the future are not a substitute for that assessment.
Checks to make before using the program
| Check | What should be clear |
|---|---|
| Authorization | Which systems the team may test and who granted permission. |
| Tier | Whether the task falls under Defense, Red Team, or Specialized. |
| Data | What information will be transmitted and which retention terms apply to the account. |
| Results | How findings will be validated and who is responsible for fixing or reporting them. |
Keep exploring
Sources consulted
Corrections and transparency
If you spot incorrect or outdated information, send us a correction with the page and source we should review.
Submit a correction