Anthropic Formalizes Tiered Access for Security Teams

Anthropic is replacing its initial security testing pilot with a formal, tiered system that gates access to its most capable models based on the nature of a security team's work. The expanded Cyber Verification Program introduces three distinct levels of access, acknowledging that the same systems useful for patching vulnerabilities are equally capable of exploiting them.

The baseline tier, Defense Access, is built for standard security operations, reverse-engineering malware, and incident response. This tier is broadly available to internal security teams, nonprofits, open-source maintainers, and individual researchers with a proven track record. It grants access to models like Claude Opus 5.5 and Claude Mythos 5.1 but maintains strong classifiers that block offensive cyber actions.

The next level, Red Team Access, allows authorized penetration testing and adversarial testing. Individual researchers are excluded; this is strictly for organizations. Anthropic notes that even at this level, users will face "real-time blocks on actions that could cause physical harm or mass disruption."

The highest tier, Specialized Access, removes almost all cyber blocks. It is intended for testing systems where failure could threaten lives or disrupt markets, such as power grids, telecom networks, and flight operating systems. Because of the potential risks, Anthropic is not making these access decisions alone. The company states they "currently review every organization in depth in collaboration with the US government."

This formalization tells us a few things about the maturation of the security market for foundation models. First, the models are now capable enough that broad, one-size-fits-all safeguards are no longer practical. Defenders legitimately need access to models without restricted capabilities to protect their networks. According to Anthropic, their initial pilot program partners found more than 129,000 verified software vulnerabilities over a three-month window. While that total relies on self-reported survey data from a subset of partners, and Anthropic extrapolates the true impact to be much higher, the sheer volume of automated discovery is significant.

Second, the direct involvement of the US government in approving Specialized Access sets a notable precedent. As foundation models become critical infrastructure in their own right, the line between private product access and national security oversight is dissolving. By integrating federal review into its highest access tier, Anthropic is directly coordinating the riskiest vetting with federal authorities.

Finally, there is the question of data retention. Anthropic currently requires data retention for most participants to monitor for potential cyber misuse. They plan to release a new safeguard framework later this fall, which they say will allow eligible organizations to retain data in their own controlled cloud infrastructure. In the enterprise security industry, giving a third-party vendor visibility into your unpatched vulnerabilities or active red-team operations introduces a massive operational risk. The long-term adoption of the program will likely depend on how quickly Anthropic can deliver zero-retention privacy controls without compromising their ability to police their models.

Until then, organizations will have to weigh the substantial benefits of AI-assisted vulnerability discovery against the realities of sharing their most sensitive security operations with an external provider.

What did you stop noticing because the product made it feel normal?

V