What Changed in Project Glasswing

Project Glasswing began in April 2026 as a collaborative effort to help secure critical software using Claude Mythos Preview, an advanced model that Anthropic said had demonstrated strong capabilities in vulnerability discovery and exploitation. Its initial partners included organizations involved in cloud infrastructure, operating systems, networking, security, and financial services.

The original initiative focused on a relatively restricted group of organizations responsible for important software and digital infrastructure. Anthropic subsequently expanded the initiative to additional organizations that met its security requirements.

On October 6, Anthropic announced that Project Glasswing and its existing Cyber Verification Program would be integrated into one expanded offering. The updated CVP provides three levels of access, each with different eligibility requirements and cybersecurity safeguards.

Under the announced structure, the tiers include Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models as they become available through the program. Existing Glasswing members transition to Specialized Access for the current models without needing to repeat the approval process.

The integration therefore changes more than the program's name. It establishes a framework for extending advanced cyber capabilities to a wider range of security professionals while differentiating access according to the risk of the work.

Primary source: Anthropic, "Expanding the Cyber Verification Program" .

How the Three Access Tiers Work

1. Defense Access

Defense Access is designed for routine defensive security operations. Anthropic identifies activities such as security operations center work, incident response, malware reverse engineering, and vulnerability analysis and validation as examples of qualifying tasks.

Eligible applicants may include corporate security teams, universities, nonprofits, government organizations defending systems they own or maintain, critical infrastructure operators, smaller security firms, open-source maintainers, and individual researchers with a record of reporting vulnerabilities.

Anthropic says it aims to respond to applications for this tier within a few days. The broader eligibility is intended to help legitimate defenders use advanced models without requiring every organization to qualify for the most restrictive access level.

2. Red Team Access

Red Team Access extends the permitted work to authorized penetration testing and adversarial security assessments. These activities simulate attacks to identify weaknesses before real attackers can exploit them.

Applicants may include internal red teams, government red teams, and security testing firms. Organizations must be authorized to test the systems in scope. Anthropic also says that real-time blocks remain in place for actions that could cause physical harm or mass disruption, including ransomware deployment and damage to physical systems.

The additional capabilities come with more extensive verification. Anthropic expects reviews for this tier to take a few weeks. During that review, qualifying organizations are placed in Defense Access. Individual researchers are not eligible for Red Team Access under the announced rules.

3. Specialized Access

Specialized Access is intended for a limited group of verified organizations authorized to test safety-critical systems or infrastructure whose failure could affect human lives or financial markets.

Anthropic lists examples including flight operating systems, power grids, telecommunications networks, interbank transfer infrastructure, and government administrative networks. This tier has the fewest cybersecurity restrictions among the three levels and requires an in-depth review conducted in collaboration with the U.S. government.

Existing Project Glasswing members transition to this tier for current models. The limited eligibility reflects the potential consequences of testing powerful cyber capabilities against systems that support essential services.

These categories should not be interpreted as a simple ranking of trustworthy users. They are a way to align permitted actions with the sensitivity of the work, the authority of the applicant, and the potential consequences of misuse.

Why Tiered Access Matters for Cybersecurity

Cybersecurity is a dual-use field. A technique that helps a defender find a software flaw can also help an attacker identify a route into a system. The same model may support code review, vulnerability validation, incident response, or more sensitive forms of adversarial testing.

A universal restriction can prevent some harmful use, but it can also obstruct legitimate defenders. Conversely, providing every user with unrestricted access to advanced capabilities increases the consequences of compromised accounts, malicious insiders, and users who operate outside their authorization.

Tiered access attempts to manage this tension by separating activities according to their intended purpose and potential impact. A team investigating a compromised workstation does not necessarily need the same permissions as a specialist testing a power-grid control environment.

However, verification is not a permanent guarantee of safe behavior. An approved organization may later suffer an account compromise, experience an insider threat, or allow a legitimate user to exceed the approved scope of work. Access controls therefore need to be complemented by monitoring, clear authorization records, and a process for responding to misuse.

Anthropic's Reported Vulnerability Findings

Anthropic says Project Glasswing partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026. The company also reports that its own open-source scanning efforts identified an additional 5,500 verified vulnerabilities between April and October.

More than 33,000 of these reported findings had been rated critical or high severity, according to Anthropic. The company describes the total as a lower-bound estimate based on reports from a subset of participating organizations and its open-source scanning work.

These numbers suggest that AI-assisted vulnerability discovery can operate at a scale that would be difficult to achieve through manual review alone. They should not, however, be interpreted as an independently audited measure of vulnerabilities successfully exploited in the wild, or as proof that every reported issue remained exploitable after review.

The findings also raise a practical question: how many vulnerabilities have actually been fixed? Anthropic says that fewer than half of the participating organizations disclosed patch counts in its reporting, often because remediation remained in progress. The company therefore acknowledges that its available patch-rate data is incomplete.

This limitation is important. Discovering a vulnerability is only one stage of risk reduction. Organizations still need to confirm the finding, assess exposure, develop a fix, test the fix, deploy it safely, and verify that the weakness has been closed.

What Anthropic's Safeguard Evaluation Shows

Anthropic also published results from an internal evaluation using CyScenarioBench, which measures model performance on multi-stage cybersecurity tasks under realistic constraints. The company tested Claude Opus 5.5 with safeguards configured for different CVP access levels.

Across five attempts at each of ten challenges, Anthropic reported the following results:

• Without CVP access, all 50 task attempts were blocked at the first prompt.
• In Defense Access, 46 of 50 attempts were blocked at some point during the challenge; four tasks succeeded.
• In Red Team Access, no blocks occurred during the evaluation, and the model completed 34 of 50 tasks.

These results illustrate the trade-off behind tiered access: stronger restrictions can reduce task completion, while fewer restrictions allow more adversarial work to proceed.

The figures are Anthropic's own evaluation results, not an independent certification that the program prevents real-world misuse. A benchmark can reveal how safeguards behave on selected scenarios, but it cannot represent every attacker, compromised account, novel technique, or operational setting.

A credible safety assessment should therefore consider more than whether a model completes a benchmark task. It should also evaluate whether authorization checks hold under pressure, whether misuse is detected quickly, whether access can be revoked, and whether the resulting incident can be contained.

Source: Anthropic's published CVP evaluation and program details .

The Remediation Gap May Matter More Than Discovery Speed

AI-assisted scanning can increase the number of vulnerabilities discovered, but the security benefit depends on what happens next. If a company identifies weaknesses faster than its engineering teams can validate and fix them, its backlog may grow even while its detection capabilities improve.

This is not merely a theoretical concern. Security teams often work with legacy applications, limited maintenance windows, dependencies that cannot be upgraded immediately, and systems that require extensive regression testing. Critical infrastructure may also need formal change approval to avoid disrupting essential services.

For these organizations, the useful measure is not the number of AI-generated findings alone. It is the time between discovery and verified remediation, adjusted for severity, exposure, and operational impact.

Organizations adopting AI-based vulnerability discovery should track several outcomes:

• The proportion of findings confirmed as genuine vulnerabilities.
• The time needed to triage and prioritize confirmed findings.
• The time from confirmation to deployment of a tested fix.
• The number of high-risk vulnerabilities that remain open beyond the organization's remediation targets.
• The rate of false positives, duplicate reports, and fixes that introduce new defects.

These measures help determine whether AI is reducing actual exposure rather than simply increasing the volume of security work. Faster discovery is valuable, but the ultimate objective is fewer exploitable weaknesses in production systems.

Governance and Privacy Questions Remain

Anthropic says that organizations enrolled in the program must permit data retention for monitoring potential cyber misuse. The company has also described plans for Enterprise Frontier Safeguards, intended to combine stronger privacy protections with safeguards while allowing eligible customers to store data in infrastructure they control.

This creates a governance consideration for participating organizations. Security teams may need to analyze source code, incident logs, or other sensitive operational information. Before enrolling, they should understand what data is retained, who can access it, how it is used for monitoring, and what contractual and technical protections apply.

These questions are particularly important for organizations subject to regulatory obligations, confidentiality agreements, or restrictions on the transfer of sensitive data. The exact requirements will depend on the organization's circumstances and the terms of its access arrangement.

Responsible access programs should make the relationship between security monitoring and data governance explicit. Strong cybersecurity capabilities do not remove the need to protect confidential code, customer information, and operational records.

What Security Leaders Should Do Next

The expanded CVP may be relevant to organizations that need advanced AI assistance for defensive work. Before applying, security leaders should establish a clear operational plan.

1. Define the authorized scope. Identify which applications, code repositories, and systems may be tested, and document who has authority to approve that work.
2. Choose the appropriate access level. Match the intended activity to the program's published requirements. Do not assume that approval to conduct defensive analysis authorizes testing against unrelated third-party systems.
3. Protect sensitive data. Review data-retention, access, and confidentiality requirements before sending proprietary code or incident information to an AI service.
4. Keep humans accountable for consequential actions. Require review before changes are deployed to production or before testing affects critical systems.
5. Build a remediation workflow. Connect AI-generated findings to triage, ownership, patch testing, deployment, and verification rather than treating a model's output as a completed security fix.
6. Measure results and prepare for misuse. Track remediation times and false positives, retain appropriate audit logs, and establish procedures to revoke access or stop activity that exceeds its scope.

Conclusion: Access Controls Are a Starting Point, Not a Guarantee

Anthropic's integration of Project Glasswing into a three-tier Cyber Verification Program is a significant change in how the company distributes advanced cybersecurity capabilities. It creates a structured path for more defenders to use models that can assist with vulnerability discovery and authorized security testing.

Yet the effectiveness of this approach will depend on more than vetting applicants or adjusting model safeguards. It will depend on the quality of authorization checks, the ability to detect and contain misuse, the protection of sensitive data, and the speed at which discovered vulnerabilities are fixed.

The reported findings from Project Glasswing indicate substantial potential for AI-assisted vulnerability discovery, but the available figures also have important reporting and remediation limitations. They should be treated as evidence of potential, not as a complete measure of security improvements across the industry.

For security leaders, the practical lesson is clear: AI can strengthen vulnerability management when it is integrated into an accountable process. More findings do not automatically mean safer systems. The decisive outcome is whether organizations can reduce real-world exposure faster than new risks emerge.

Frequently Asked Questions

What is Project Glasswing?

Project Glasswing is an Anthropic-led initiative launched in April 2026 to help secure critical software by giving selected organizations access to Claude Mythos Preview for defensive cybersecurity work.

What changed in October 2026?

Anthropic integrated Project Glasswing with its Cyber Verification Program into a single offering with Defense Access, Red Team Access, and Specialized Access.

Which models are included?

Anthropic's October 6 announcement lists Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1, and future models as they become available through the program. Access is subject to the relevant tier's requirements.

Does approval guarantee that a user cannot misuse the models?

No. Verification and safeguards can reduce risk, but approved accounts can still be compromised and authorized users can act outside their permitted scope. Monitoring, authorization controls, and incident response remain necessary.

Do the reported vulnerability figures prove that systems are safer?

Not by themselves. The figures indicate the volume of vulnerabilities reported as verified through the initiative and Anthropic's scanning work. The actual security benefit depends on validation, remediation, deployment, and confirmation that the weaknesses have been addressed.

Sources and References

1. Anthropic. (2026, October 6). Expanding the Cyber Verification Program. https://www.anthropic.com/news/cyber-verification-program
2. Culafi, A. (2026, October 7). Anthropic Gives Vetted Defenders Fewer Claude Guardrails. Dark Reading. https://www.darkreading.com/vulnerabilities-threats/anthropic-vetted-defenders-claude-guardrails
3. Anthropic. (2026, April 7). Project Glasswing: Securing Critical Software for the AI Era. https://www.anthropic.com/glasswing
4. Anthropic. (2026, June 2). Expanding Project Glasswing. https://www.anthropic.com/news/expanding-project-glasswing

Editorial methodology: Program descriptions and reported vulnerability figures are attributed to Anthropic. Dark Reading provides additional reporting and industry commentary. Analysis of remediation, authorization, privacy, and operational risk represents editorial interpretation and recommendations, not claims that a specific organization failed to implement these controls.