Anthropic
Blogcast

Alex: Welcome back to the Anthropic Blogcast, where we break down the latest from Anthropic so you do not have to read the blog yourself. I am Alex.

Jordan: And I am Jordan. Today we are digging into a security announcement with a genuinely hard tradeoff at its center. Anthropic is expanding its Cyber Verification Program, which gives qualifying security professionals access to Claude's advanced cyber capabilities with the safety brakes loosened. Powerful tools, deliberately placed in vetted hands.

Alex: The setup is this. Cybersecurity is inherently dual use. The same capability that lets a security team find and fix a vulnerability can also help a malicious actor exploit it. So Anthropic's generally available models, like Claude Opus five point five, have conservative cyber safeguards that block most cyber work. That keeps dangerous capabilities away from attackers, but it also locks out the defenders.

Jordan: And defenders keep running into exactly that wall. You are a security engineer doing legitimate work on systems you own, and the model refuses to help because it cannot tell you apart from someone with bad intentions. Anthropic's answer, after six months of running two pilot programs, is to fold them into one expanded offering: the Cyber Verification Program, with three tiers of verified access.

Alex: Let us walk through the three tiers, because the design here is doing a lot of careful thinking. First, Defense Access. This is for defensive work: security operations center and incident response tasks, reverse engineering malware, and analyzing and validating vulnerabilities.

Jordan: Who qualifies is deliberately broad. Security teams at companies, nonprofits, universities, and government bodies defending systems they own or maintain. Operators of critical infrastructure of any size, so think regional hospitals or municipal utilities, not just the giant grids. Smaller security firms. Open source maintainers. And individual researchers with a track record of reported vulnerabilities.

Alex: That last one matters. They did not restrict this tier to big organizations. A solo researcher with a real history of finding and reporting bugs can get in. Anthropic says it expects many organizations doing defensive work to qualify, and they aim to answer applications within a few days.

Jordan: Tier two is Red Team Access. This adds authorized penetration testing and red teaming on top of everything Defense Access covers. Qualifying organizations are in-house red teams, government red teams, and security and penetration testing firms. And there is an important constraint: you can only do adversarial testing against systems you are authorized to test, including I T systems in critical industries.

Alex: And unlike Defense Access, the safeguards are not fully removed here. Users still get real time blocks on actions that could cause physical harm or mass disruption. The post names examples: deploying ransomware, damaging physical systems, or pen testing high risk safety systems. So the model helps you break into things, but draws the line at anything that could hurt people or break infrastructure.

Jordan: The review bar is higher too. Applications in this tier take a few weeks to review, and only organizations qualify, individual researchers are not eligible. While the review is pending, approved organizations get enrolled in Defense Access, so they are not stuck waiting.

Alex: Then the third tier, Specialized Access, has the fewest cyber blocks. It is reserved for a limited set of verified organizations authorized to test safety systems that could affect people's lives or disrupt markets. The examples are stark: flight operating systems, power grids, telecom networks, interbank transfer infrastructure, and government administrative networks.

Jordan: This is where the verification gets serious. Every organization in this tier is reviewed in depth in collaboration with the U S government. That is a striking sentence in a product announcement. And existing members of Project Glasswing, the earlier program for the most critical software, transition to this tier automatically without needing reapproval for current models.

Alex: Now, what do all three tiers actually unlock? Access to Anthropic's most capable models with the cyber brakes adjusted for the tier, including Claude Opus five point five, Claude Sonnet five point five, and Claude Mythos five point one, plus new models going forward. Mythos is the model line with the strongest cyber capabilities, and it has stayed tightly restricted until now.

Jordan: There is also a data tradeoff, and Anthropic is upfront about it. Data retention is required for enrolled organizations so Anthropic can monitor for cyber misuse. That is the price of reduced safeguards: they watch what happens. Later this fall, they plan to launch Enterprise Frontier Safeguards, a new option combining zero data retention with robust safeguards, letting eligible organizations store data in cloud infrastructure they control. Until that ships, organizations that already have zero data retention on certain models can keep it while using the program.

Alex: And a practical note for the rest of us: the generally available models are not being stripped of everything. They remain available for code review, patching known issues, vulnerability finding in owned source code, and triage of security alerts. The program is for the work the default safeguards block, not for everyday secure coding.

Jordan: Now the part of the announcement I found most interesting: they actually measured whether the tiers work as designed. They ran Claude Opus five point five through an evaluation called CyScenarioBench, which tests whether a model can plan and execute multi stage cyber operations under realistic constraints, with the safeguards tuned to each tier.

Alex: The results are a clean gradient. Without the program, every single task was blocked on the very first prompt. In the Defense Access tier, forty-six of the fifty trials were blocked at some point, with four tasks succeeding. And in the Red Team tier, no blocks occurred at all, and the model completed thirty-four of the fifty tasks, which the post says is effectively equivalent to its sixty-seven point six percent success rate with no safeguards applied at all. So the tiers calibrate almost exactly as intended: block by default, mostly block at defense, free at red team.

Jordan: That is a rare thing in a corporate announcement, a measurement that actually pins the claim. The safeguards are not theater, they genuinely stop the model most of the time at the defensive tier, and they genuinely get out of the way at the red team tier.

Alex: Then they quantify what the predecessor program actually achieved, and the numbers are striking. Through Project Glasswing, partner organizations uncovered at least one hundred twenty-nine thousand verified software vulnerabilities between April and July of twenty twenty-six. Anthropic's own open source scanning found another five thousand five hundred between April and October.

Jordan: Of those, more than thirty-three thousand have been rated critical or high severity so far. And the post stresses this is likely an undercount, based on survey data from only a subset of Glasswing partners. They estimate the true impact is at least five times higher.

Alex: Several partners told Anthropic that the models increased their rate of vulnerability finding by months or even years. So the case for the program is empirical, not theoretical: put these models in the hands of vetted defenders and the bugs get found and fixed dramatically faster.

Jordan: The availability details: the program is available on the Claude platform, Google Cloud's Vertex A I, and Microsoft Foundry. On Amazon Bedrock it is only available for customers eligible for the Enterprise Frontier Safeguards option. Admins assign access to specific workspaces, and the full tier details live in Anthropic's help center. Interested organizations apply through a form, with all applicants verified and asked for proof of the required security controls.

Alex: There is a bigger story underneath this announcement. Back in June, Anthropic said releasing Mythos broadly would require safeguards against misuse that it, and to its knowledge all other A I developers, had not yet developed. The October answer is not better safeguards. It is vetting. The fix for a dangerous capability is deciding who gets it.

Jordan: That is the sentence that stayed with me. When you cannot build a safeguard that cleanly separates attackers from defenders, the only remaining lever is identity and trust. The program is essentially a licensing regime for A I capabilities, with three license classes, government collaboration at the top end, and continuous monitoring as the price of admission.

Alex: And the numbers give them confidence to widen it: one hundred twenty-nine thousand verified vulnerabilities found by the vetted few, so open the program to many more vetted defenders. The defenders' advantage, as the post puts it, made permanent.

Jordan: If you are on a security team and the default model's refusal has been blocking your work, this is your door in. Links to the announcement in the show notes. I am Jordan.

Alex: And I am Alex. See you next time on the Anthropic Blogcast.