Anthropic opens its strongest hacking-capable AI to more security teams

Security work has an awkward problem. The same skill that helps a defender find and fix a hole can help an attacker use it. Anthropic calls this "dual use."

So the versions of Claude that anyone can sign up for ship with conservative cyber safeguards. Anthropic says these block most cyber work on Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5. The goal is to limit what a malicious user can do.

The catch: real defenders need strong tools too. A hospital's security team doesn't want to be blocked while it pulls apart a piece of malware that just hit its network.

Regular Claude can still help with the everyday stuff. Anthropic lists code review, patching known issues, finding vulnerabilities in code you own, and sorting security alerts.

For the past six months, Anthropic ran two separate programs for trusted defenders.

• Project Glasswing: gave a group of organizations that secure the most critical software access to Claude Mythos, Anthropic's strongest cyber model.
• The original Cyber Verification Program (CVP): gave vetted security teams access to Claude Opus and Sonnet models with reduced safeguards.

Now the two are becoming one program. Anthropic says the point is to give more security organizations the capabilities they need. Every tier includes Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, plus new models as they arrive.

Think of it like a building with key cards. Everyone in the program gets in the front door, but only some cards open the server room. Each tier has its own verification rules and required security controls.

Defense Access

This tier covers defensive work: running a security operations center, responding to incidents, reverse-engineering malware, and analyzing vulnerabilities.

Anthropic's list of who qualifies is broad:

• Organizations: security teams at companies, nonprofits, universities and government bodies defending systems they own or maintain.
• Infrastructure: operators of critical infrastructure of any size, such as regional hospitals or municipal utilities.
• Smaller players: smaller security firms and open-source maintainers.
• Individuals: researchers with a track record of reported vulnerabilities.

Anthropic says it expects many defensive organizations to qualify and aims to answer applications within a few days.

Red Team Access

This adds authorized penetration testing and red-teaming. A "red team" is a group paid to attack its own side, so the real attackers find fewer surprises.

In-house red teams, government red teams and pen-testing firms can apply. They may only attack systems they're authorized to test. Claude will still block, in real time, actions that could cause physical harm or mass disruption, like deploying ransomware or damaging physical systems.

Reviews take a few weeks. Applicants get Defense Access while they wait. For now, individual researchers aren't eligible.

Specialized Access

This is the tier with the fewest blocks. It's for a limited set of organizations authorized to test systems that could affect people's lives or disrupt markets: flight operating systems, power grids, telecom networks, interbank transfers and government networks.

Anthropic reviews every one of these organizations in depth together with the US government. Existing Glasswing members move into this tier and don't need reapproval for current models.

It did, with a benchmark called CyScenarioBench. It checks whether a model can plan and carry out multi-step cyber operations under realistic limits.

Anthropic ran Claude Opus 5.5 through 10 challenges, five attempts each, for 50 trials per tier. Here's what happened:

• No program access: every task was blocked on the very first prompt.
• Defense Access: 46 of 50 trials were blocked at some point; the other 4 succeeded.
• Red Team Access: no blocks at all, and Claude completed 34 of 50 tasks.

That 34 of 50 is the same completion rate the model gets with no safeguards at all, which is how Specialized Access works. In other words, the safety filters stayed out of the way where they were supposed to and stepped in where they were supposed to.

In real life If you run security for a small city water utility, you could apply for Defense Access, get an answer within days, and then ask Claude to help reverse-engineer a suspicious file without hitting a wall of refusals.

This is the part that sounds like a season finale. Anthropic says Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026.

Anthropic's own open-source scanning added 5,500 more verified vulnerabilities between April and October, and more than 33,000 of all of them have been rated critical or high severity so far.

By the numbers: Anthropic says these figures are likely an undercount. They come from partial data in 33 partner reports and its open-source work. Because survey data covered only some partners, Anthropic expects the true impact to be at least five times higher.

Several partners told Anthropic that Mythos sped up their bug-finding by months or even years. Fewer than half disclosed how many bugs they had patched, often because fixes were still in progress.

AI finding security holes in real software is becoming a regular headline. Last week, Epic paused most development on MyChart after Mythos found flaws, and Google launched Gemini 4 Argon to vetted defenders first.

Why it matters: organizations in the program must allow data retention, so Anthropic can watch for misuse. For security teams handling sensitive logs, that's a real trade-off.

Anthropic says a fix is coming. Enterprise Frontier Safeguards (EFS), due later this fall, combines zero data retention with safeguards. Eligible organizations will then be able to store data in cloud infrastructure they control.

Until then, organizations that already use Claude Fable 5.1 or Claude Mythos 5.1 with zero data retention can use the program the same way.

How to apply

Organizations apply through Anthropic's site. Anthropic verifies every applicant and asks for proof of the security controls each tier requires.

• Existing members: keep their current settings for older models and are automatically evaluated for Opus 5.5, Sonnet 5.5 and Mythos 5.1.
• Platforms: the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry.
• Amazon Bedrock: only for customers eligible for Enterprise Frontier Safeguards.
• Admins: must assign access to specific workspaces.

If a member gets blocked on work its tier should allow, Anthropic has a form to report it. It says it will keep refining the classifiers that decide what gets blocked.

• If you work in security: Defense Access is aimed broadly, including small firms, hospitals, utilities and open-source maintainers, so it's worth applying.
• If you maintain open-source code: expect more bug reports. Anthropic says it's continuing work to help secure open-source software.
• If you just use apps: more of the software you rely on may get patched faster, as AI helps defenders find holes before attackers do.
• If you use regular Claude: nothing changes. It still blocks most offensive cyber work.