← Back to feed

Anthropic updated Project Glasswing on October 6 with the most consequential change since the initiative launched in April: a formal three-tier Cyber Verification Program that allows qualifying security professionals to access its most capable models with reduced content filtering.

The Cyber Verification Program (CVP) grants access to Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1, with the top tier — Specialized Access, which absorbs existing Glasswing members — carrying what Anthropic describes as “advanced cyber capabilities and reduced blocking classifiers.” In practice, that means the models will help with offensive security work that standard API access would decline.

Why Glasswing exists

Anthropic launched Project Glasswing on April 7, 2026 alongside twelve major partners: Amazon Web Services, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA, Palo Alto Networks, and Anthropic itself. The trigger was an internal observation about a then-unreleased model.

Claude Mythos2 Preview, which Anthropic has not released publicly, demonstrated that frontier AI had crossed a threshold in vulnerability research. The model found thousands of high-severity vulnerabilities, including flaws in every major operating system and web browser. Anthropic’s assessment: “AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities.”

The initiative was framed explicitly as a race condition. Capability proliferation is moving faster than defensive deployment. Ten years after the first DARPA Cyber Grand Challenge, AI is now competitive with the best human vulnerability researchers — and that capability will not stay inside a handful of well-resourced labs.

What the CVP covers

Anthropic committed up to $100 million in usage credits for Mythos Preview across Glasswing efforts and $4 million in direct donations to open-source security organizations. Over 40 additional organizations that build or maintain critical software infrastructure received access to scan both their own code and open-source systems they depend on.

The October 6 three-tier structure formalizes what had been ad hoc access decisions. Organizations can apply for the tier that fits their work — a distinction that matters because the reduced filtering at higher tiers creates meaningful capability differences for offensive research.

The policy tension

The CVP raises a direct question: how do you give vetted defenders better tools than attackers can acquire, when the models involved are increasingly capable of generating attack capabilities at scale?

Anthropic’s answer is identity verification and operational vetting, applied tier by tier. That approach depends on the vetting process being robust enough to exclude actors willing to misrepresent their use case — an assumption that is difficult to audit once access is granted and the outputs are produced locally.

The alternative, not granting the access at all, leaves defensive security teams outgunned by adversaries who will eventually obtain equivalent capabilities through other means. Neither option is clean. The CVP is a bet that controlled, verified deployment gets more value to defenders than the risk it creates by expanding the access surface.