Mechanism: Anthropic assigns model capabilities and safeguard settings by tier, linking broader offensive testing capability to stronger applicant verification and security controls. Defense Access covers defensive work; Red Team Access adds authorized penetration testing; Specialized Access is reserved for a limited set of organizations testing sensitive systems. The program requires applicant verification and proof of relevant controls, and Anthropic says enrolled organizations must retain data for misuse monitoring, subject to stated zero-data-retention exceptions.
Why now: Anthropic says it is integrating Project Glasswing and its existing Cyber Verification Program into one expanded offering to extend access to more security organizations. Its evaluation offers a concrete illustration of the intended separation: without CVP, all 50 CyScenarioBench trials were blocked; Defense Access blocked 46 of 50; Red Team Access had no blocks and completed 34 of 50.
Evidence boundary: The benchmark results and program impact figures are Anthropic-reported; the source describes five attempts on each of ten benchmark challenges and acknowledges partial partner reporting for vulnerability counts. These are not an independent audit or evidence of real-world outcomes.
First implication: Security teams seeking advanced cyber capabilities must qualify according to the work they perform and demonstrate relevant controls.
First watch condition: Watch whether applications are approved on the timelines Anthropic gives for each tier and whether it reports evidence that tier-specific safeguards work beyond its benchmark.
The announcement records an access-policy change rather than a new model launch. It also states that CVP is available through the Claude Platform, Google Cloud Vertex AI, and Microsoft Foundry, while Amazon Bedrock access is limited to customers eligible for Enterprise Frontier Safeguards. The practical boundary is therefore both organizational and platform-specific. A further test will be whether teams can complete legitimate work without excessive blocking while keeping higher-risk capabilities restricted to authorized activity.