Anthropic opens its cyber AI to verified teams: what it entails

Anthropic has decided to open the door for more security teams to use its most capable models with fewer restrictions. It does so by expanding its Cyber Verification Program (CVP), an initiative that until now combined Project Glasswing —access to Claude Mythos for organizations protecting critical software— with the CVP itself, which gave access to Claude Opus and Claude Sonnet with reduced security measures. The new development is that both are merged and structured into three levels according to the type of authorized work.

Three levels, three levels of risk

The expanded program offers verified organizations access to Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, as well as future models, with different degrees of cyber restriction. The logic is simple: the greater the potential offensive capability, the greater the verification and the smaller the margin for error. The levels are:

• Defense Access: designed for defensive tasks such as security operations, incident response, malware reverse engineering, and vulnerability analysis and validation.
• Red Team Access: adds authorized penetration testing and red team operations, but only on systems for which the user is authorized.
• Specialized Access: the least restricted level, reserved for a limited set of verified organizations authorized to test critical systems such as flight operating systems, power grids, telecommunications networks, interbank transfer infrastructure or government administrative networks. Anthropic evaluates these requests in collaboration with the U.S. Government.

Current Glasswing members move directly to the Specialized Access level without having to reapply for approval for their current models. Anthropic justifies the move with an idea we share: defenders also need the best tools to protect their systems.

What the tests say (and what they don't)

Anthropic tested the levels with CyScenarioBench, an evaluation designed to measure whether a model can plan and execute multi-stage cyber operations. It subjected Claude Opus 5.5 to 10 challenges with five attempts per challenge at each level. Without CVP access, all 50 attempts were blocked on the first request. With Defense Access, 46 of 50 were blocked at some point and four succeeded. With Red Team Access, none were blocked and the model completed 34, a rate equivalent to the 67.6% it would obtain without security measures.

These numbers should be read with caution. Sakshi Grover, IDC's research director, recalls that this is a test by the provider itself, not an independent one. And her reading is accurate: the results show why authorization and scope matter when using AI for security testing. Since the steps can resemble those of an attacker, legitimacy depends on authorization, target scope and execution conditions, not on the technique itself.

When model-level refusals are reduced, controls must be placed outside the model.

Why this matters to an SME

At first glance, an Anthropic program with government verification and access levels to critical systems sounds distant for a 30-employee SME in Seville. But there are two useful readings. The first is about direction: the industry is admitting that general-purpose models carry conservative brakes that generate false positives even in legitimate secure coding tasks. That explains why many internal teams perceive that AI "won't let them do anything" when they review code or analyze an incident. The second is about governance: the tiered model anticipates how privileged access in AI will be structured, and that pattern can be copied at small scale.

At ForgeNEX we see it every week: the SME doesn't need the most powerful model without restrictions, it needs to know what it can do, with what limits and who is accountable. If your team starts using AI assistants to review configurations, analyze logs or prepare security tests, the debate is no longer whether or not to enable the model, but how to control what it does.

What we recommend doing

Deepika Giri, vice president of AI platforms at IDC, points to a key condition: the tiered approach only works if verification is real and access continues to be checked once granted, because an agent's behavior can change over time. Grover adds that, when model-level refusals are reduced, controls must be placed outside the model. Translated to an SME or a modest IT team, this translates into several actions:

1. A distinct identity for each agent: no sharing a generic account across tools. Each agent must have its own identity and permissions.
2. Short-lived privileges: access only for the specific task and for the necessary time, not permanent credentials.
3. Independent verification of objectives and actions: someone or something other than the agent confirms what is going to be touched and what has been touched.
4. Containment and recovery tests: before granting broad access, verify that you know how to stop the agent and revert its changes.
5. Human oversight on high-impact actions: as Giri recommends, treat the agent like an employee with privileges, not like a black box.
6. Clear accountability: researcher Vibhum Dubey insists on establishing who is accountable for the system's actions. In an SME, that means a person with a first and last name.

This move by Anthropic fits a trend we have already been observing: AI stops being a chat and becomes an operator with permissions. A few weeks ago we analyzed how new decision models are reaching SOCs, and the pattern repeats: more autonomy demands more governance. It also connects with what we learned when analyzing Claude as a driver engineer: AI performs when the environment is well bounded.

Our practical recommendation for an SME is not to wait until you have your own SOC to sort this out. Start by inventorying which AI assistants touch systems, with what credentials and who approves them. If you can't answer those three questions in less than five minutes, you have work ahead of you. The expansion of the CVP doesn't affect you directly if you don't do offensive cybersecurity, but the philosophy of levels, verification and external controls should land in your internal policy this same quarter.

Source: Computerworld. Analysis and adaptation: ForgeNEX.