Anthropic expanded its Cyber Verification Program on Tuesday, allowing approved security personnel to test its strongest models with less protection. This move was triggered by Project Glasswing, which helped uncover over 100,000 software vulnerabilities this year.

Glasswing partners found at least 129,000 verified vulnerabilities from April to July. Anthropic's own open-source scans found another 5,500 from April to October. Over 33,000 of these have been classified as critical or high risk. The company stated that these figures come from a survey of limited partners, and the actual impact is likely underestimated, with expectations of at least five times the current figures.

The new Cyber Verification Program consolidates two parallel programs from the past six months. Glasswing originally only allowed the most powerful Claude Mythos to be used by organizations protecting critical software. The old verification program reduced protection for approved security teams using Claude Opus and Sonnet. When the Claude Mythos Preview was announced in April, there were concerns that the model could be exploited before software patches were applied.

The new program is divided into three tiers, each with its own review and security controls, allowing access to Claude Opus 5.5, Sonnet 5.5, Mythos 5.1, and subsequent models. The Defense tier covers incident response and malware analysis, and security teams, critical infrastructure operators, open-source maintainers, and researchers with a history of vulnerability reporting can apply. The Red Team tier adds authorized penetration testing and red teaming, accepting only institutional applications.

The Specialized tier has the least restrictions and is reserved for a small number of approved organizations testing security-critical systems, including power grids, flight systems, and interbank transfer infrastructure. Each member is reviewed by Anthropic and the U.S. government, with existing Glasswing members transitioning to this tier.

This is an access distribution, not funding. Buyers are those looking to scan their own code and critical systems for defenses, while sellers are Anthropic's high-capacity model quotas. The driving force is that the speed of vulnerability discovery exceeds the speed of patching. Beneficiaries include key software maintainers who can enter the Specialized tier, as well as security companies selling patches, validation, and hosting scans. Those under pressure include penetration teams relying on manual vulnerability discovery and ordinary software vendors facing attack windows after the same batch of vulnerabilities is disclosed but unable to access Mythos.

Source: Public Information