Anthropic Expands Access to Frontier Cyber AI Models

Artificial Intelligence & Machine Learning , Next-Generation Technologies & Secure Development

Applications for advanced artificial intelligence-powered cyber defense are now open to any organization, Anthropic said Tuesday, broadening access to its most capable tools as open-weight models narrow the gap.

See Also: Webinar | Can You Account for What Your AI Agents Do With Sensitive Data?

The expanded Cyber Verification Program combines Project Glasswing, which gave a select group access to Claude Mythos, with Anthropic's existing verification program, which reduced safeguards on Claude Opus and Sonnet for vetted security teams. The new structure offers three tiers of access to those capabilities.

The move reflects the next phase of AI-powered cyber defense: extending advanced capabilities beyond a small group of large companies to all defenders who need to act quickly, as widely available models put similar tools within reach of attackers.

Security professionals find broader access to advanced tooling a right step toward defending AI-speed attacks, as defenders get early visibility into vulnerabilities.

"I'm actually more worried about defenders being artificially held back than I am about capable cyber AI becoming widely available," said Aviv Nahum, co-founder and CEO at insider risk protection service provider Above Security. "These capabilities are going to proliferate across models and providers regardless. The goal has to be making sure defenders have equally capable systems [as attackers] and can use them continuously across investigation, detection and response."

Anthropic said the program is intended to put advanced cyber capabilities with fewer restrictions into the hands of more security defenders. Any organization can apply for the access tier that fits its work.

The lowest tier supports security operations centers, malware analysis and vulnerability validation for security researchers, open-source maintainers, critical infrastructure operators and bug bounty hunters.

A red-teaming tier for penetration testing teams supports offensive tasks such as authorized adversary emulation and exploit validation.

What used to be Project Glasswing has morphed into a top tier that allows offensive security testing against critical safety systems such as flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks, Anthropic said.

"For this tier, we currently review every organization in depth in collaboration with the U.S. government. Existing members of Project Glasswing will transition to this tier and do not require reapproval for current models," the AI firm said.

Enterprises say the lowest tier may have the broadest practical use because it helps security analysts triage and define vulnerability remediation.

Nahum said for organizations like his that offer security protection, defense is the most natural starting point. "We care much more about using frontier models to investigate behavior, analyze vulnerabilities and understand attacks than about removing every safeguard for offensive testing," he said.

Anthropic's advanced models have already shown they can uncover vulnerabilities at scale - at least 129,000 verified software vulnerabilities between April and July, the company said. EpochAI's CVE tracker also showed a sharp increase in high-severity vulnerabilities stemming from 21 notable organizations following the adoption of Claude Mythos Preview.

But few of those vulnerabilities were found to be exploited.

Researcher Patrick Garrity from threat intelligence firm VulnCheck found only two out of 300 CVEs identified through Project Glasswing ended up in exploits. A Google investigation published Sept. 30 found the largest proportions of vulnerabilities found by AI are medium to low risk, while high-risk flaws accounted for only 3%.

But experts say exploitation is not the best measure of a model's cybersecurity utility. Low exploitation rates can actually mean that AI-powered defense is enhancing security. "A 1% exploitation rate isn't a sign of failure - it's proof that proactive defense is working as intended," said John Gallagher, vice president at operation technology and IoT security firm Viakoo.

Exploitation can also take time to be discovered, said Andrew Yoon, head of research at nonprofit education program CivAI. "Even when exploits are developed, they are often not used against real targets immediately. Once an exploit is used against a real target, it may take time for researchers to recognize it and link it back to a disclosed CVE, if the connection is ever made," Yoon said.

A vulnerability also does not become important only after it is exploited, so neither exploitability nor the sheer number of vulnerabilities AI finds should define the tool's value, said Diana Kelley, CISO at AI security and governance platform Noma Security.

"Risk depends on how likely exploitation is in that environment, the business impact if it happens and whether compensating controls reduce the likelihood or consequences. A valid finding on an exposed critical system is different from one behind effective isolation," Kelley said.

"The useful measure is not 'how many bugs eventually got exploited?' It is how much faster defenders can discover, validate and understand meaningful weaknesses than they couldn't before," Nahum said.