Published Oct. 6, 2026, at 7:24 p.m. EDT. Anthropic is expanding access to its most capable cybersecurity-focused artificial-intelligence models for vetted security professionals, combining two restricted programs into a new three-tier Cyber Verification Program.
The company said its Project Glasswing partners identified at least 129,000 verified software vulnerabilities between April and July 2026. More than 33,000 have been rated critical or high severity. Anthropic reported another 5,500 verified vulnerabilities from its own open-source scanning between April and October.
Three access tiers for defensive security work
According to Anthropic’s Oct. 6 announcement, the expanded program provides qualifying participants access to Claude Opus 5.5, Sonnet 5.5, Mythos 5.1 and future models, with different verification requirements and safeguards for each tier.
- Defense: Incident response, malware analysis, vulnerability research and defensive work by qualified teams, infrastructure operators, maintainers and researchers.
- Red Team: Authorized penetration testing and red-team exercises conducted by organizations.
- Specialized: Tightly vetted work involving safety-critical systems such as power grids, flight systems and interbank-transfer infrastructure.
Anthropic said applicants will be vetted with the U.S. government. Existing Glasswing participants will move into the Specialized tier.
What the vulnerability figures do—and do not—show
The company described the totals as a lower bound because the figures are based partly on reports from 33 partners. An Oct. 6 Reuters report noted that Anthropic expects the overall impact to be larger, but those estimates remain company claims rather than an independent census of all flaws found or fixed.
The expansion reflects the dual-use problem surrounding advanced cyber models: the same capabilities that help defenders locate weaknesses can also assist attackers. The tiered system is intended to widen defensive access while retaining identity checks, use restrictions and model controls.
Organizations considering the program should review the eligibility requirements and their own authorization rules before conducting any testing. Finding a vulnerability does not by itself establish that it was exploitable in production or that a patch has already reached users.
Read more in Technology and Artificial Intelligence.
Featured image: Photo by Jake Walker on Unsplash. Image is illustrative.
[…] have emphasized increasingly capable models and expanded cybersecurity access, including Anthropic’s expanded verification program. Those developments can reinforce both optimism about AI’s benefits and concern about […]