For most of the past year, the most capable cyber tools Anthropic builds have sat behind a gate. This week the company opened that gate a little wider, and it published the receipts for what those tools had already found: more than 134,000 verified software vulnerabilities since April, across its partners and its own scanning.
Anthropic said it is combining two earlier programs, its Cyber Verification Program and Project Glasswing, into a single offering with three tiers of access to its most capable models, including Claude Opus 5.5 and the Mythos models built for security work. The tiers are meant to give security professionals the advanced cyber capabilities while reducing the automated blocks that normally stop such work.
The first tier, Defense Access, is for defensive work: security operations, incident response, reverse-engineering malware, and validating whether a reported bug is real. It is open to teams defending their own systems, critical-infrastructure operators, small security firms, open-source maintainers, and individual researchers with a record of reporting vulnerabilities.
The second, Red Team Access, adds authorized penetration testing and red-teaming, and it is reserved for organizations, in-house and government red teams and security testing firms. Participants may only test systems they are permitted to attack, and the models still block in real time the things Anthropic will not allow anywhere: deploying ransomware, damaging physical systems, or testing high-risk safety systems. A third, specialized tier sits above both.
The vetting process can take weeks, and qualifying organizations get Defense Access while they wait. The structure, according to the company, hands the strongest capabilities to people whose job is defense rather than attack, a compromise the company has been working toward under pressure from regulators and customers alike.
The program is an expansion, not a debut. Anthropic launched the Cyber Verification Program last year with a small group of approved researchers, and Project Glasswing ran separately with partners testing Claude’s ability to find flaws. Folding the two together and publishing the numbers turns a quiet capability into a public argument, aimed at both the security industry and the policymakers who have been asking how AI companies will keep powerful models out of the wrong hands.
The numbers behind the program are the part that drew the industry’s attention. Anthropic said its Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July, and that its own open-source scanning found another 5,500 between April and October. More than 33,000 of the total have been rated critical or high severity. The company cautioned that the figures undercount the real total, because they draw on reports from only a subset of partners.
The company said the Claude Mythos models had significantly increased the rate at which organizations found vulnerabilities in their own systems, and it estimated the true number of flaws uncovered is likely at least five times higher than the figures it published, because only some Glasswing partners reported their results. That is the shape of Anthropic’s claim: the tools work, and the number everyone sees is the conservative one.
Those numbers cut two ways. They are evidence that AI can find real flaws in real systems at a pace human teams cannot match, which is the argument Anthropic makes to the companies and agencies it wants as customers. They are also a public record of how many holes already exist in the software the world runs on, which is the argument regulators make when they ask whether AI will make the problem worse before it makes it better.
For the model-makers, the program is a way to answer a question that has dogged the industry: what is an AI company supposed to do when its product is good at both attacking and defending. Anthropic’s answer is to give the attacking side to people who have passed a background check and committed to use it only against systems they own. The alternative, releasing the capability to everyone, is what its safety rules exist to prevent.
Rivals are watching. OpenAI, Google and others have built similar programs for their own security researchers, and the contest to be the lab that defenders trust is as real as the contest for cloud contracts. A company that can credibly say it finds more vulnerabilities than its rivals, and hands the tools only to vetted hands, gains a marketing edge that a pure capability race does not provide.
What Anthropic has not resolved is whether the gate can hold. The same models it gives to approved red teams are, in most cases, the same models the public can already use, with safety filters the company has been steadily loosening. The program is a bet that trust and vetting can substitute for the filters themselves. Whether that bet survives the first time a vetted user goes rogue is the question the whole industry will be watching.
