Anthropic's three cyber tiers turn model safeguards into an access-control system

Anthropic says Project Glasswing partners identified at least 129,000 verified software vulnerabilities between April and July 2026, while its own open-source scanning found another 5,500 through October. More than 33,000 of the verified findings were rated critical or high severity. The operational change announced on 6 October is not simply broader Claude access: Anthropic has folded Glasswing into a three-tier Cyber Verification Program that varies cyber safeguards according to verified purpose and organisation.

Capability is becoming an entitlement, not a model setting

The three levels separate defensive work, authorised red teaming and specialised testing of safety-critical systems. Defense Access covers activities such as incident response, malware analysis and vulnerability validation. Red Team Access adds authorised penetration testing, while Specialized Access is reserved for verified organisations testing systems such as power grids, telecom networks and interbank infrastructure.

That structure matters because the same model can operate under materially different restrictions. Anthropic reports that its Defense Access configuration blocked 46 of 50 CyScenarioBench trials at some point. Its Red Team configuration produced no safeguard blocks and completed 34 of 50 tasks, close to the model's unsafeguarded evaluation result.

When model capability changes with verified purpose, access to the model becomes a privileged security entitlement.

Identity and authorisation now sit in the AI control plane

Enterprises adopting tiered cyber models should not treat enrolment as a procurement flag attached to an API account. The entitlement needs an owner, an approved use case and a mapped set of identities. Workspace assignment should follow least privilege, with separate access for defenders and red teams rather than a shared credential that inherits the organisation's highest approved tier.

The review also needs evidence. Record who approved the tier, which workspaces received it, what systems may be tested and when that authority expires. Anthropic requires data retention for enrolled organisations, subject to stated exceptions and its planned Enterprise Frontier Safeguards offering. That makes retention and privacy configuration part of the access decision rather than an unrelated platform setting.

Re-certify the entitlement when the model or mission changes

The programme includes future models, so approval cannot be treated as permanent evidence that every later capability is appropriate. Security teams should re-evaluate privileged model access when the model family, testing scope or target environment changes. For Red Team and Specialized Access, authorisation records should also identify the systems the organisation is permitted to test.

The broader lesson extends beyond Anthropic. As AI providers expose stronger capabilities selectively, enterprise IAM has to represent not only who may call a model, but which capability regime that identity may invoke. Model access is becoming another privileged control surface, and it should be governed with the same lifecycle discipline as production administration.

Produced through Devence Lab's automated research and publishing workflow, without prepublication human review. Devence Lab retains editorial responsibility. Sources are linked; report factual errors to contact@devencelab.com.

Written by the Devence Lab research team.