Anthropic Launches Tiered Access for its Advanced Models

Anthropic has reorganized its Cyber Verification Program on Tuesday (6), which makes its most capable models available with fewer restrictions for vetted security professionals. The program now features three levels of access and incorporates Project Glasswing, an initiative that previously included a limited group of partners. Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 will be available at all levels, with future models being added as they are released, according to the company's announcement.

The figures that Anthropic uses to justify this opening stem from Glasswing. Between April and July 2026, the project's partners identified over 129,000 verified software vulnerabilities, of which more than 33,000 were classified as critical or high severity, according to the company. The aim is to distribute this volume of discovery beyond just a few organizations.

How the Three Levels Work

Defense Access, the entry-level tier, encompasses defensive work: SOC operation, incident response, malware reverse engineering, and vulnerability validation. Access can be requested by security teams from companies, NGOs, universities, and public agencies defending their own systems, as well as open-source maintainers and individual researchers with a history of reported vulnerabilities. Individuals only qualify for this level and must be on a paid plan. Anthropic cites critical infrastructure operators "of any size," from a regional hospital to a municipal sanitation company, as an example.

Red Team Access allows authorized penetration testing and red teaming against systems that the organization has permission to attack. It is limited to organizations, including internal teams, government agencies, and pentesting firms. Specialized Access, the most restrictive tier, serves organizations authorized to test systems critical for safety, such as flight operations, electrical networks, and interbank infrastructure. According to Anthropic, these reviews are currently conducted in collaboration with the U.S. government.

The analysis of applications for Defense Access takes a few days. For Red Team Access, it may take a few weeks, but eligible candidates receive defensive access while waiting. None of the levels has an associated fee: the program is free and application-based, although usage of the models is still billed normally.

The Week That Explains the Urgency

This announcement comes amid a series of severe vulnerabilities in edge and collaboration products. Atlassian disclosed CVE-2026-21589, with a CVSS score of 9.3, which allows an unauthenticated attacker to read files across eight Data Center products, including Jira, Confluence, and Bitbucket. CISA has added two vulnerabilities of Citrix NetScaler, CVE-2026-88771 and CVE-2026-88772, both allowing remote code execution, to its catalog of exploited vulnerabilities. Days earlier, Fortinet had patched a zero-day in FortiMail that was already being exploited.

For a CISO, the equation is straightforward to state and challenging to solve: the number of critical vulnerabilities requiring triage grows faster than the team. A model that accelerates the analysis of a patch, reproduces a vulnerability, or inspects a suspicious binary reduces the time between alert and fix, which is the window that attackers exploit.

The Dual-Use Dilemma

The same capability that assists the defender also aids the attacker, which is why Anthropic maintains restrictions for the general public. The tiered design shifts some of the burden onto verification: the company must decide who is a legitimate defender based on documentation and history. Critics of this model argue that identity verification does not prevent abuse by those already holding credentials or by employees of an approved organization. Defenders argue that more sophisticated attackers already have access to unrestricted models and that denying tools to defenders only increases asymmetry.

The explicit mention of the U.S. government at the most sensitive level also has international implications. Operators of electrical networks and interbank systems in Europe, subject to the NIS2 directive, or regulators in Japan and Brazil, remain uncertain whether their reviews will undergo oversight from Washington or local authorities. Anthropic did not detail how it handles applicants from outside the U.S. in the Specialized Access tier.

For consultancies with managed security practices, the practical effect is different. Red Team Access can accommodate pentesting companies of any size, leveling the playing field for access to cutting-edge models between a boutique with few analysts and the security division of a Big 4 firm. Competitive advantage, from now on, depends less on who possesses the model and more on who can effectively use it within the contracted scope and document that for the client.