Illustration of two hands framing a keyhole, used by Anthropic for its Cyber Verification Program announcement — Anthropic announced the expanded Cyber Verification Program on October 6, 2026. Image: Anthropic.

AI cybersecurity took a real step forward this week. On October 6, 2026, Anthropic opened its most capable models to far more security teams, with fewer safety blocks for verified defenders.

Reuters reported that Anthropic is opening its most powerful AI models to more security teams. This follows its Project Glasswing work, which helped find well over 100,000 software flaws this year.

I have read the announcement, the help center rules and the news coverage. Below is what changed, who qualifies, and what agencies and IT teams in India and the USA should do about it.

What Anthropic Announced for AI Cybersecurity

Anthropic has rebuilt its Cyber Verification Program, or CVP. The program gives qualifying security professionals "reduced blocking classifiers." In plain words, the model stops refusing legitimate security work as often.

For the past six months, Anthropic ran two separate programs:

Project Glasswing gave a group of organizations securing critical software access to Claude Mythos, its most cyber-capable model family.
The original CVP gave vetted security teams reduced safeguards on Claude Opus and Claude Sonnet.

Now both sit under one program with three tiers. Every tier includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and future models. What changes from tier to tier is how much offensive work the model will help with.

Why the gate at all? Anthropic puts it simply: cybersecurity is dual use. The same skill that helps a team find and fix a bug can help an attacker exploit it. So its public models keep conservative cyber safeguards that block most cyber work.

The Three CVP Tiers, Explained Simply

Here is how the tiers break down, based on Anthropic's official Cyber Verification Program post.

1. Defense Access

This tier covers defensive work. Think security operations center tasks, incident response, malware reverse engineering, and checking whether a reported vulnerability is real.

Anthropic lists security teams at companies, nonprofits, universities and government bodies as examples. They must be defending systems they own or maintain. Critical infrastructure operators of any size qualify too, such as regional hospitals and municipal utilities.

Smaller security firms, open-source maintainers and individual researchers with a record of reported bugs can also apply. Anthropic expects many defensive teams to qualify and aims to respond within a few days.

2. Red Team Access

This tier adds authorized penetration testing and red teaming. It is meant for in-house red teams, government red teams, and security and pen testing firms.

There are firm limits. Teams can only test systems they are authorized to test. Real-time blocks still apply to actions that could cause physical harm or mass disruption, like deploying ransomware.

Reviews take a few weeks. While you wait, your organization is placed in Defense Access. Individual researchers cannot apply for this tier right now.

3. Specialized Access

This tier has the fewest cyber blocks. It is reserved for a small group of verified organizations authorized to test systems that could affect lives or markets. Anthropic names flight operating systems, power grids, telecom networks, interbank transfers and government administrative networks.

Anthropic reviews every organization here in depth with the US government. Existing Glasswing members move into this tier without reapproval for current models.

Anthropic table comparing Generally available, Defense Access, Red Team Access and Specialized Access tiers by users, uses and security controls — Anthropic's overview of who each Cyber Verification Program tier is for and the controls it requires. Image: Anthropic.

Why AI Cybersecurity Access Is Being Gated

Anthropic tested the tiers on CyScenarioBench. This evaluation checks whether a model can plan and run multi-stage cyber operations under realistic limits. It ran Claude Opus 5.5 five times on each of 10 challenges, per tier.

The results show how differently each tier behaves:

Without CVP access: every task was blocked on the first prompt.
Defense Access: 46 of 50 trials were blocked at some point. Four succeeded.
Red Team Access: no blocks at all. The model finished 34 of 50 tasks.

That 34 of 50 result roughly matches the model's 67.6% success rate with no safeguards at all. So for authorized red teams, the brakes come off almost fully. For defenders, offensive-style tasks stay mostly blocked, which is the intent.

The context matters too. Reuters noted that the April unveiling of Claude Mythos Preview raised fears that AI could hack software before it was secured. These tiers are Anthropic's answer to that worry.

What Project Glasswing Found

The numbers behind this change are large. According to Anthropic, Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026. Anthropic's own open-source scanning found another 5,500 between April and October.

More than 33,000 of those flaws were rated critical or high severity. Anthropic says the real impact is likely at least five times higher, since the data comes from only 33 partner reports.

One detail stood out to me. Fewer than half the partners shared patch numbers, often because fixes were still in progress. Anthropic's own survey table shows 9,333 patched flaws across all severities. Finding bugs is getting faster. Fixing them is still the slow part.

Anthropic table of Project Glasswing survey results showing candidate findings, true positive, high and critical severity, and patched vulnerabilities — Project Glasswing survey results from 33 partners plus Anthropic's open-source scanning. Image: Anthropic.

What This Means for Agencies and IT Teams

Most web and software agencies are not pen testing firms. But many of us run security reviews, maintain open-source packages, or handle incidents for clients. That puts a lot of agencies close to the Defense Access line.

Here is how I would read it for different teams:

Team type	Likely tier	What to watch
Agency doing code reviews and patching	Generally available models are enough	Keep work inside code you own or maintain
Managed IT or SOC provider	Defense Access	Identity checks and security attestations
Open-source maintainer on your team	Defense Access	A record of reported vulnerabilities helps
Security or pen testing firm	Red Team Access	Written client authorization for every test
Fintech, telecom or utility vendor	Possibly Specialized Access	Deep vetting with the US government

Anthropic is clear that its normal models still handle everyday secure coding. That includes code review, patching known issues, finding vulnerabilities in your own source code, and triaging security alerts. Many agencies will not need CVP at all.

We covered the defender side earlier in our Claude Security guide for agency teams. If you offer testing services, our post on AI penetration testing and Hadrian's funding is a useful companion read.

The rules that will trip teams up

The help center adds details that are easy to miss:

Apply once per organization. Admins assign seats. Staff should not apply one by one.
Stronger logins are coming. Defense Access members have until December 15, 2026 to adopt phishing-resistant multi-factor authentication and stop using API keys. Until then, API keys expire every seven days.
Data retention is required. Anthropic keeps data to monitor for misuse. A zero data retention option called Enterprise Frontier Safeguards is due later this fall.
Client products need separate approval. Building a client-facing product on these capabilities falls under Anthropic's Cyber Productization Policy.
Platform limits apply. CVP works on the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry. On Amazon Bedrock it is only for customers eligible for Enterprise Frontier Safeguards.

Point four matters most for agencies. If you plan to wrap Mythos inside a security product for clients, CVP approval alone is not enough.

An AI Cybersecurity Checklist for India and USA Teams

Here is a short plan I would follow this month:

Decide if you need CVP. List the security tasks your team runs. If it is code review and patching, stay on standard models.
Get authorization in writing. For any client testing, keep signed scope documents. Red Team Access depends on testing only what you are cleared to test.
Fix your own access controls first. Move to phishing-resistant MFA and short-lived credentials. Drop long-lived API keys where you can.
Check data rules with clients. Retention is required for now. Some clients may not accept that for sensitive code until zero retention options arrive.
Plan for more bug reports. If AI finds flaws faster, your patch pipeline needs to keep up. Track what is being exploited using the CISA Known Exploited Vulnerabilities catalog.
Join the walkthrough. Anthropic runs a CVP webinar on October 14 at 9 AM PT, which is 9:30 PM IST.

Notes for Indian agencies

Many Indian agencies run development and support for US clients. If your client in the US is a hospital or utility, they may qualify for Defense Access on their own. Your team may then work inside their approved workspace.

For Indian clients, keep CERT-In's incident reporting rules in mind. Faster bug discovery means more findings to triage, document and, where needed, report on time.

Key Takeaways

Anthropic merged Project Glasswing and its old CVP into one program with three tiers on October 6, 2026.
All tiers include Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. The tier decides how much offensive work is allowed.
Defense Access suits SOC teams, hospitals, utilities, smaller security firms and open-source maintainers.
Red Team Access is for organizations doing authorized pen testing. Specialized Access is vetted with the US government.
Glasswing partners found at least 129,000 verified flaws from April to July 2026, but patching lags far behind.
Plan for phishing-resistant MFA by December 15, required data retention, and a separate policy for client products.

Want help setting up secure AI workflows or reviewing how your team handles code and credentials? Our team offers software development consulting for agencies and growing businesses in India and the USA.

About the Author

Nitin Kumar is Lead Project Coordinator at Debugged Pro. He manages web, cloud and AI projects for startups and growing businesses in India and the USA. He writes practical guides on security and delivery that teams can act on quickly.