Anthropic expands its Cyber Verification Program into three tiers, and Claude Opus 5.5 clears 34 of 50 red-team trials

Because cyber capability is inherently dual use, Anthropic consolidated trusted access for defenders from two programs into one Cyber Verification Program with three tiers, so security teams can apply for the model access that matches the scope of their work. Over the past six months, Project Glasswing gave organizations securing the most critical software access to Claude Mythos, while the CVP gave vetted security teams reduced safeguards on Claude Opus and Claude Sonnet models, as two separate channels. Generally available models such as Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5 keep conservative cyber safeguards that block most cyber work, intended to limit what malicious actors can carry out with the models.

The three tiers are Defense Access, Red Team Access and Specialized Access, with verification requirements and security controls tightening at each level and the degree of relaxed blocking rising with them. Defense Access covers security operations center and incident response tasks, malware reverse engineering, and vulnerability analysis and validation; Red Team Access adds authorized penetration testing and red-teaming; Specialized Access has the fewest cyber blocks and is reserved for a limited set of verified organizations authorized to test systems such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks. Red Team Access users still hit real-time blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware, damaging physical systems or pen testing high-risk safety systems; Specialized Access organizations are currently reviewed in depth in collaboration with the US government, and existing Project Glasswing members transition to that tier.

To assess whether tiered safeguards work, Anthropic ran Claude Opus 5.5 through CyScenarioBench, an evaluation of whether models can plan and execute multi-stage cyber operations under realistic constraints. Because the evaluation involves complex, interactive offensive scenarios, significant blocks were expected on the generally available model and in Defense Access, and no blocks in Red Team Access and Specialized Access. Across five attempts at each of the 10 CyScenarioBench challenges in each tier, 50 trials per tier, no CVP access blocked every task at the first prompt; Defense Access blocked 46 of 50 trials at some point with the remaining four succeeding; Red Team Access had no blocks and completed 34 of 50, effectively equivalent to the model's 67.6% success rate with no safeguards applied.

The report covers the three-tier CVP structure, application and review process, and Claude Opus 5.5's CyScenarioBench trial results with safeguards tuned per tier; that evaluation targets multi-stage attack scenarios and measures whether models can plan and execute cyber operations under realistic constraints.

Anthropic says it will keep refining its tier-based classifiers; Specialized Access is currently reviewed organization by organization, Red Team Access is for organizations only and individual researchers are not eligible; partner vulnerability counts come from survey data covering only a subset of Glasswing partners, and the authors expect the true impact to be at least five times higher.