Anthropic Expands Cyber Verification Program, Allowing Approved Security Personnel to Test Its Strongest Models with Less Protection
Anthropic expanded its Cyber Verification Program on Tuesday, allowing approved security personnel to test its strongest models with less protection. This move was triggered by Project Glasswing, which helped uncover over 100,000 software vulnerabilities this year.
Glasswing partners found at least 129,000 verified vulnerabilities from April to July. Anthropic's own open-source scans found another 5,500 from April to October. Over 33,000 of these have been classified as critical or high risk. The company stated that these figures come from a survey of limited partners, and the actual impact is likely underestimated, with expectations of at least five times the current figures.
The new Cyber Verification Program consolidates two parallel programs from the past six months. Glasswing originally only allowed the most powerful Claude Mythos to be used by organizations protecting critical software. The old verification program reduced protection for approved security teams using Claude Opus and Sonnet. When the Claude Mythos Preview was announced in April, there were concerns that the model could be exploited before software patches were applied.
The new program is divided into three tiers, each with its own review and security controls, allowing access to Claude Opus 5.5, Sonnet 5.5, Mythos 5.1, and subsequent models. The Defense tier covers incident response and malware analysis, and security teams, critical infrastructure operators, open-source maintainers, and researchers with a history of vulnerability reporting can apply. The Red Team tier adds authorized penetration testing and red teaming, accepting only institutional applications.
The Specialized tier has the least restrictions and is reserved for a small number of approved organizations testing security-critical systems, including power grids, flight systems, and interbank transfer infrastructure. Each member is reviewed by Anthropic and the U.S. government, with existing Glasswing members transitioning to this tier.
This is an access distribution, not funding. Buyers are those looking to scan their own code and critical systems for defenses, while sellers are Anthropic's high-capacity model quotas. The driving force is that the speed of vulnerability discovery exceeds the speed of patching. Beneficiaries include key software maintainers who can enter the Specialized tier, as well as security companies selling patches, validation, and hosting scans. Those under pressure include penetration teams relying on manual vulnerability discovery and ordinary software vendors facing attack windows after the same batch of vulnerabilities is disclosed but unable to access Mythos.
Source: Public Information
ABAB AI Insight
Anthropic did not publicly release the Claude Mythos Preview in April, only including it in Glasswing. In the May interim update, about 50 partners found over 10,000 critical or severe vulnerabilities in mission-critical software within a month. Cloudflare found 2,000 vulnerabilities on critical paths, of which 400 were critical or severe, claiming a lower false positive rate than manual testing. Mozilla found and fixed 271 vulnerabilities in Firefox 150, which is more than ten times the number found using an earlier model on Firefox 148. During the same period, it also scanned over 1,000 open-source projects.
This time there is no new funding; it is a reallocation of model permissions. The old structure allowed critical software organizations to access Mythos, while approved security teams accessed reduced protection versions of Opus and Sonnet. The new structure consolidates the two channels into three tiers, with the highest tier requiring joint review with the U.S. government, and existing Glasswing members moving directly into this tier. The motivation is to keep offensive and defensive capabilities with the defenders while delineating boundaries that cannot be loosened for systems like power grids, flight systems, and interbank transfers.
In comparison, Google Project Zero uses internal researchers to find vulnerabilities ahead of time and then provides vendors with a patching window, while Microsoft includes vulnerability disclosures in MSRC. The difference is that Anthropic is not selling researcher slots but rather model tiers. The industry position is in a control phase: the discovery capability has already been internally validated, and the current action is to determine who can use it and on what types of systems.
Structurally, this is a technological substitution. The bottleneck of vulnerability discovery has shifted from experienced testers to models, with partners reporting a tenfold increase in discovery speed as early as May. The mechanism is that once discovery becomes cheap, the scarce resources become verification, patching, and exposure windows. In September, security researchers tracked 225 vulnerability IDs related to Glasswing or Anthropic, confirming that only one was exploited in the wild. After the model identifies vulnerabilities, the real constraint shifts to who gets the highest tier access first and who patches first.
ABAB News · Cognitive Laws
Once discovery becomes cheap, patching becomes the bottleneck.
The stronger the capability, the more access must be tied to regulation.
Finding vulnerabilities does not equate to vulnerabilities being exploited.