Anthropic unties Claude's hands for security pros

Ask any security analyst about using commercial LLMs for work, and they will give you the same weary sigh: you paste in a deobfuscated payload to analyze an active incident, and the AI immediately panics, claims you are orchestrating an exploit, and refuses to answer.

Because cybersecurity capabilities are inherently dual-use, major AI labs have kept guardrails on a hair-trigger. But that often means malicious actors jailbreak models underground, while defenders protecting actual infrastructure spend half their day fighting their own safety filters.

Anthropic overhauled its Cyber Verification Program (CVP) into a structured three-tier system. The initiative grants vetted security pros reduced-classifier access to frontier models, including Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1.

Three tiers of access

The update merges the earlier Project Glasswing and the initial CVP pilot into a unified structure, grouping users by their operational scope.

The entry level is Defense Access, designed for security operations centers, incident response, reverse-engineering malware, and vulnerability triage. Corporate security teams, universities, regional utilities, open-source maintainers, and individual researchers with documented disclosure records can apply. Anthropic aims to clear these within a few days.

Next is Red Team Access, which unblocks authorized penetration testing. This tier is restricted to organizations only, requiring strict proof of authorization to test target systems. Actions capable of causing physical destruction, disabling high-risk safety systems, or launching ransomware remain blocked in real time. Applications take several weeks to clear.

The most permissive level is Specialized Access, tailored for high-stakes environments where failures threaten public safety or financial stability, such as air traffic control, electrical grids, telecom hubs, and interbank transaction networks. Anthropic evaluates these candidates in direct coordination with the US government. Former Project Glasswing partners transition here automatically.

The benchmark differences are staggering. When tested against CyScenarioBench, an offensive evaluation with multi-stage attack scenarios, standard Claude Opus 5.5 was blocked on the very first prompt in all 50 trials. In the Red Team tier, blocks dropped to zero, and the model completed 34 of the 50 multi-step operations—matching its unconstrained 67.6% ceiling.

The vulnerability tally

Anthropic points to raw field data to justify unlocking its models. Between April and July 2026, partners in Project Glasswing used Claude Mythos to identify more than 129,000 verified software vulnerabilities.

Anthropic internal scans discovered an additional 5,500 vulnerabilities in open-source projects between April and October. Out of the combined pool, over 33,000 were tagged as high or critical severity. Enterprise partners like Booz Allen and Comcast noted the system compressed years of auditing into months.

Access comes with trade-offs. Enrolled organizations must permit data retention for misuse monitoring until Anthropic ships its Enterprise Frontier Safeguards (EFS) architecture later this fall, which promises zero data retention on customer-managed clouds. CVP is available across Claude Platform, Google Cloud Vertex AI, and Microsoft Foundry, with Amazon Bedrock access gated behind the upcoming EFS framework.

Why it matters

For security engineers, this change removes the exhausting prompt-engineering overhead required to bypass overzealous safety filters. Being able to run deep binary decompilation or authorized exploit reproduction without arbitrary refusals makes Claude a genuinely viable defensive copilot. If you manage an active defense team or maintain critical open-source packages, getting verified for Defense Access is an immediate operational win.

Strategically, Anthropic is building the first formal regulatory bridge between frontier dual-use models and sovereign cyber defense. Instead of pretending advanced reasoning can be completely scrubbed of offensive potential, they are turning compliance, verification, and government oversight into a moat. This will likely force rivals to establish their own government-aligned red-team vetting programs.

The friction point, however, is data handling. Forcing red teams to log sensitive vulnerability testing on vendor infrastructure is an uncomfortable compromise for any mature security practice. Until the zero-retention EFS tooling launches, plenty of air-gapped enterprises and defense contractors will keep their most sensitive research far away from the program.