Anthropic expands its Cyber Verification Program into three access tiers with Opus 5.5, Sonnet 5.5 and Mythos 5.1; Red Team tier completes 34/50 CyScenarioBench tasks with zero blocks

Anthropic's 2026-10-06 post folds Project Glasswing (Mythos access for organizations securing critical software) and the original Cyber Verification Program (reduced safeguards on Opus/Sonnet) into one program with three tiers. Defense Access covers SOC work, incident response, malware reverse engineering and vulnerability validation, and is open to company/nonprofit/university/government security teams, critical-infrastructure operators of any size, small security firms, open-source maintainers and individual researchers with a disclosure track record; Anthropic aims to answer in days. Red Team Access adds authorized penetration testing for organizations only (weeks to review), while still blocking actions like ransomware deployment or damaging physical systems. Specialized Access, with the fewest blocks, is for verified organizations testing safety-critical systems such as power grids, flight systems, telecom and interbank transfer networks, reviewed in collaboration with the US government; Glasswing members transfer automatically. Every tier includes Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. Data retention is required until Enterprise Frontier Safeguards ships later this fall. On CyScenarioBench (10 challenges x 5 attempts), GA models were blocked on the first prompt every time, Defense tier blocked 46 of 50 trials, and Red Team tier had zero blocks and completed 34 of 50, equivalent to the 67.6% no-safeguard success rate. Anthropic also reports Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026, plus 5,500 from its own open-source scanning, with more than 33,000 rated critical or high. CVP is available on Claude Platform, Vertex AI and Microsoft Foundry; Bedrock only for EFS-eligible customers.