On October 6, Anthropic introduced an expanded Cyber Verification Program (CVP) that consolidates its previous cyber verification initiatives and Project Glasswing into three access tiers. The updated program provides vetted defensive and offensive security professionals with tailored access to frontier models, including Opus 5.5, Sonnet 5.5, and Mythos 5.1, with future models to follow.
The company positions the move as an effort to equip network defenders and authorized testers with capable tools while maintaining restrictions designed to prevent malicious exploitation. The program does not grant unrestricted public access to Mythos 5.1, nor does it remove safeguards universally across all tiers. Applicants must be verified and meet their tier’s security requirements; approval does not authorize testing systems without permission.
Three Vetting Tiers and Model Restrictions
The restructured CVP separates participants into three named tiers based on organization type, vetting depth, and intended use case:
- Defense Access: Designed for security operations centers (SOC), incident response teams, malware reverse engineering, and vulnerability validation on owned or maintained infrastructure. Eligible applicants include security teams across commercial enterprises, non-profit groups, academic institutions, government bodies, critical infrastructure operators, and smaller entities, as well as individual researchers and open-source contributors with an established track record. Individual researchers must hold a qualifying paid plan, while organizational applications handle team-wide access.
- Red Team Access: Intended for defensive testing combined with authorized penetration testing and active red teaming against designated target systems. This tier is restricted exclusively to vetted organizations; individual practitioners cannot apply. The company maintains real-time behavioral blocks designed to prevent high-risk safety violations, critical mass disruption, physical damage, and ransomware operations.
- Specialized Access: Restricted to a tightly limited group of verified organizations authorized to test critical systems, including power grids, civil aviation, telecommunications networks, interbank financial systems, and government infrastructure. Acceptance into this tier requires an in-depth review conducted in coordination with the U.S. government.
Existing Project Glasswing participants will transition into the updated program without reapproval for currently approved models, while terms from the prior CVP framework remain in place for earlier model versions as newly provisioned models undergo review. Review depth and timelines vary by tier; applying does not guarantee approval.
Data Retention and Cloud Availability
CVP normally requires data retention so Anthropic can monitor for misuse. The company plans to introduce Enterprise Frontier Safeguards (EFS) later this fall, allowing eligible organizations to store data in cloud infrastructure they control. Until EFS is available, organizations that already have zero data retention (ZDR) access to Fable 5.1 or Mythos 5.1 can also use CVP with ZDR.
Platform access depends on the hosting provider and administrative provisioning:
- Claude Platform, Google Cloud Vertex AI, and Microsoft Foundry: Available to approved participants. Console and API users must use workspaces that meet the program requirements; administrators can check program grants and workspace qualifications in the Console.
- Amazon Bedrock: Anthropic limits CVP to customers eligible for EFS. Its Help Center says current Bedrock access is limited to organizations with a data retention exemption for
Fable 5.1, which can use CVP with ZDR while EFS is pending. This is not general CVP access for all Bedrock customers.
Evaluation Benchmark Results
To evaluate performance across varying moderation profiles, Anthropic published internal benchmark testing on its CyScenarioBench suite, utilizing Opus 5.5 across 10 security-focused challenges, with five attempts at each challenge in each tier—50 trials per tier.
In testing with standard production safeguards outside the CVP, the model was blocked on its initial prompt across all 50 attempts. In the Defense tier, the model completed 4 of the 50 attempts, with automated safeguards blocking the remaining 46 tasks. In the Red Team tier, zero attempts encountered real-time moderation blocks, yielding a completion success rate of 34 out of 50 trials, or 68 percent. An unconstrained test run without safety guardrails—used by the company as an internal baseline representative of Specialized capabilities—achieved a 67.6 percent success rate (rounding to roughly 68 percent).
These are Anthropic’s results on a particular set of offensive scenarios. They show how task completion changed with the tested safeguards; they do not establish reliability or safety on every real-world security task.
