Anthropic expanded its Cyber Verification Program on 6 October 2026 into Defense Access, Red Team Access and Specialized Access. The change gives qualifying security professionals different levels of cyber capability and reduced blocking on Claude, with requirements that rise alongside the permitted scope. It is an access-policy change, not an unrestricted release to every Claude subscriber. Anthropic’s announcement defines the three tiers.
The practical question for a security team is which tier matches its authorized work and whether its identity, credential and data-handling arrangements meet the requirements. This report separates eligibility from subscription access and outlines the preparation an applicant should complete before relying on the program.
News reporting cutoff: 7 October 2026, 18:02 Asia/Karachi (13:02 UTC). Official announcement and help documentation checked on 7 October. AIX Radar has not enrolled, tested restricted capabilities or reproduced Anthropic’s cyber benchmarks.
Three tiers, three different scopes
The announcement includes Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1, as well as future models. Defense covers qualifying defensive work; Red Team targets authorized offensive testing by organizations; Specialized is restricted to selected verified organizations working on consequential systems. Anthropic says high-risk restrictions remain. Approval does not authorize attacks on someone else’s systems.
| Tier | Broad intended scope | Important eligibility distinction |
|---|---|---|
| Defense Access | Security operations and defensive investigation | Qualifying individuals may apply on a paid plan |
| Red Team Access | Authorized penetration testing and red-team work | Organizations only |
| Specialized Access | Selected work on critical or consequential systems | Organizations only, with deeper review |
Choose the tier around a documented need, rather than treating the highest tier as the default objective. A team handling alerts and patching its own software may have different requirements from a firm conducting authorized adversarial testing for clients.
Ordinary security work still has a general-access route
The program help article says generally available models remain usable for secure code review, threat modeling, known-issue patching, finding vulnerabilities in your own source code and alert triage. CVP addresses additional work that may encounter cyber classifiers; it is not a prerequisite for every defensive prompt.
That distinction prevents an unnecessary migration. First identify the exact workflow that is blocked, record a non-sensitive example, and confirm that the activity falls within your authorization. A program application should explain the task and its boundary. Trying to avoid a safeguard without understanding the permitted scope creates a different problem from applying for legitimate access.
Security requirements can change how a team accesses Claude
The security requirements specify identity and credential controls. Defense requires MFA at entry and sets 15 December 2026 as the deadline for phishing-resistant MFA and ending static-key use. Interim Defense API keys must be protected and replaced at least weekly. Red Team has stricter controls from access, including short-lived credentials, managed devices and restricted network egress for agentic or offensive work.
The same requirements say individual Defense traffic is retained and monitored; zero data retention is not available for those individual grants. Do not infer a data-retention exemption from an existing subscription or a different product’s settings.
Before applying, map the systems that hold credentials and the people who can use them. Include local machines, automation jobs, gateways and contractors. An access grant can be operationally unusable if an integration still depends on a shared static key or an unmanaged personal computer.
Assign someone to maintain that map. A one-time application review is not enough when users join, leave or change duties. The sensible preparation is a working offboarding and revocation procedure, not simply a statement that the organization takes security seriously.
Approval, provisioning and usage costs are separate questions
Anthropic’s help article says existing Glasswing or CVP members do not need to reapply to join the expanded program. It describes linked-account and provisioning steps that vary by platform. Third-party apps must support CVP, and Specialized Access is not offered through those apps. Some model access through cloud providers can trail approval, so an approved application should not be treated as immediate availability in every interface.
Approval is also not a free-usage promise. Check the applicable plan, usage credits, provider billing and model limits in the account where the work will run. Do not estimate a project budget from the program’s announcement alone. This article does not quote a universal price because the access route and usage arrangement matter.
For an implementation plan, separate four milestones: eligibility confirmed, grant approved, intended account provisioned, and a permitted workflow successfully exercised. Record the evidence for each. That avoids reporting a model as ready just because an application form was accepted.
A preparation checklist for an authorized security team
- Describe the work precisely. Identify the assets, ownership or written authorization, expected inputs and outputs, and activities outside scope. Use a representative sanitized example.
- Choose the account and platform. Confirm that the intended provider or third-party app supports the relevant program tier. Identify the administrator responsible for provisioning.
- Review identity and credentials. Check MFA, named user access, workload identities, key handling and revocation. Record any deadline that affects the integration.
- Review retained material. Decide which logs, source fragments and investigation details can be sent under the applicable terms. Remove secrets and unnecessary personal information.
- Begin with contained, authorized cases. Use a sandbox and a reviewer-approved task. Record useful findings, incorrect conclusions and refusals without treating reduced blocking as improved accuracy.
- Prepare for access changes. Keep a manual workflow and an incident contact. A team should be able to continue essential defensive work if a model, grant or integration becomes unavailable.
These are preparation recommendations. They are not claims that AIX Radar completed an application, security assessment or restricted-model test.
Why fewer blocks do not establish better security outcomes
Anthropic publishes its own evaluation results in the announcement. They help describe the provider’s design, but this report does not independently validate those results or use them as proof of reliability in a reader’s environment. A model can comply with a task and still misidentify a vulnerability, invent evidence or propose a change that breaks software.
Keep expert review, reproducible evidence and normal change controls around any output. The significant news is broader, differentiated access for verified work. Whether that access helps a particular team depends on its authorized tasks, operational controls and the quality of the resulting evidence.
