Anthropic folds Glasswing into three tiers of cyber access

Its most open tier, for flight, grid and bank-transfer systems, is reviewed with the U.S. government; Anthropic says partners found at least 129,000 flaws.

Anthropic is splitting access to its most cyber-capable Claude models into three vetted tiers, and it says the top tier is reviewed with the U.S. government. The change folds Project Glasswing, its program giving select organizations access to Claude Mythos, into an expanded Cyber Verification Program.

The company laid out the tiers in an Oct. 6 post. Each tier can use Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1. The higher the tier, the fewer cyber blocks.

The rule in English

Anthropic’s public models block most cyber work. The company says that is meant to limit what attackers can do with them. Security teams that want the blocks loosened now apply for one of three tiers:

Defense Access: For defensive work, such as incident response, malware reverse-engineering and checking vulnerabilities. Anthropic names company and government security teams, hospitals, municipal utilities, open-source maintainers and individual researchers with a record of reported flaws. It aims to answer applications “within a few days.”
Red Team Access: Adds authorized penetration testing against systems a group is allowed to test. Organizations only, no individuals. Review takes “a few weeks.” Real-time blocks stay on actions such as deploying ransomware or damaging physical systems.
Specialized Access: The fewest blocks. It is for a limited set of groups authorized to test systems such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. “We currently review every organization in depth in collaboration with the US government,” Anthropic writes. The post does not name an agency.

Who wrote it, and who it binds

This is a company access policy, not a law. It binds Anthropic’s customers who want looser cyber filters. Enrolled groups must accept data retention so Anthropic can watch for misuse. There is one exception for now: “Until EFS is available, organizations with access to Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can also use CVP with zero data retention.” EFS is Enterprise Frontier Safeguards, which Anthropic says is due “later this fall” and will let eligible organizations store data in cloud infrastructure they control.

Who it exempts

Existing Glasswing members move straight to Specialized Access and “do not require reapproval for current models.” Existing program members keep their settings on older models. Anthropic’s generally available models keep their existing cyber safeguards; the company says they can still be used for code review, patching known issues and alert triage.

Anthropic’s numbers

Anthropic tested Claude Opus 5.5 on CyScenarioBench, its name for a set of 10 multi-stage attack scenarios, five tries each. By the company’s count:

With no program access, every task was blocked on the first prompt.
In Defense Access, 46 of 50 trials were blocked at some point.
In Red Team Access, nothing was blocked, and the model finished 34 of 50, which Anthropic says matches its rate with no safeguards.

Anthropic also says Glasswing partners found at least 129,000 verified vulnerabilities from April to July 2026. It calls that a lower bound from partial data in 33 partner reports and its open-source partnerships, and says it expects the true impact to be “at least five times higher.” Those are company figures. Anthropic cites no outside check.

What a security team, founder or parent should do differently

Security teams and founders: If your work keeps hitting Claude’s cyber blocks, Defense Access is the fast lane. Plan for data retention and proof of security controls.
Critical-infrastructure operators: Anthropic says it vets top-tier applicants in collaboration with the U.S. government. Ask your security vendors which tier they hold.
Parents and schools: Anthropic’s generally available models keep their existing cyber safeguards.

What’s next

When Enterprise Frontier Safeguards ships, letting eligible groups store data in cloud infrastructure they control.
Whether Anthropic or the government says which agency vets Specialized Access.
The further open-source and infrastructure findings Anthropic says it will share “in the coming weeks.”

— Simone Adler