Anthropic’s October cyber-access update: what technical leaders should evaluate

Anthropic’s October 6, 2026 update expands its Cyber Verification Program (CVP), a system for giving qualifying security professionals access to advanced AI capabilities with different safeguards. The update combines CVP and Project Glasswing into one offering with three access tiers. [1]

This follows the April 7, 2026 announcement of Project Glasswing. That earlier announcement described Claude Mythos Preview as unreleased and discussed finding zero-day vulnerabilities: software flaws not yet known to the vendor or defenders. That historical description should not be read as the release status of every model available today. [2]

What changed

According to Anthropic, Defense Access covers defensive security work. Red Team Access adds authorized attack simulations, such as penetration testing. Specialized Access is reserved for a limited set of verified organizations working on sensitive systems. Existing Glasswing members transition to Specialized Access. These are provider-defined categories, not assurances that a particular reader qualifies. [1]

Access comes with conditions

Anthropic’s current help page says individual applicants can seek Defense Access on a paid plan; the other tiers are for organizations. Applicants must supply verification information, describe their security work, and attest to applicable controls. Its Usage Policy still applies, and grants may be narrowed or withdrawn. [3]

The help page also says ordinary CVP access does not authorize a client-facing product or service; that requires separate approval. Data retention is normally required, with stated exceptions for certain existing zero-data-retention access. A team must check its own circumstances before sharing code or data. [3]

Questions for technical leaders

Our editorial recommendation is to assess fit before considering a pilot:

• Does the intended work match the permitted scope, and who owns the authorization to test it?
• Do the applicable data-handling conditions fit the organization’s requirements?
• What independent review would distinguish a useful finding from a false alarm?
• Who would validate a proposed fix before any production change?

These are proposed decision criteria, not instructions to begin testing or a claim that access has been granted. Neural Wire has not tested the models or independently verified Anthropic’s performance claims. This brief makes no benchmark or return-on-investment claim.

FOLLOW THE EVIDENCE

Original sources.

1. Expanded Cyber Verification Program, October 6, 2026 ↗Anthropic
2. Glasswing dated announcements ↗Anthropic
3. Cyber Verification Program conditions ↗Claude Help Center