Cybersecurity Firms Gain Three-Tier Access to Anthropic’s Claude Mythos and Latest Models

TLDR

• Anthropic has consolidated its security access initiatives into a unified three-tier Cyber Verification Program.
• Qualified cybersecurity professionals can now access Claude Opus 5.5, Sonnet 5.5, and Mythos 5.1 models based on their tier.
• JPMorgan Chase’s Jamie Dimon warned that the Mythos model multiplied worldwide cybersecurity threats by a factor of ten.
• Organizations leveraging Claude Mythos identified over 129,000 validated software flaws from April through July 2026.
• Enterprise Frontier Safeguards, combining data privacy with abuse monitoring, will launch later this fall.

Anthropic has broadened the availability of its cutting-edge artificial intelligence systems to qualified cybersecurity professionals. The AI developer revealed the initiative on Tuesday.

We’re expanding our Cyber Verification Program to give security professionals broader access to our most capable models.

Through this program, verified security professionals can access Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 with safeguards designed for defensive work.…

— Anthropic (@AnthropicAI) October 6, 2026

This new framework merges two previous initiatives—Project Glasswing and the original Cyber Verification Program—into a unified structure featuring three distinct access levels.

The AI systems available through the program include Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1. Additional models will become accessible upon release.

The company initially provided restricted access to its Mythos system in April, targeting government entities, financial sector institutions, and leading technology firms.

Three-Tier Framework Explained

Defense Access forms the program’s entry level. This tier targets security professionals engaged in protective operations, such as breach response or vulnerability remediation.

Red Team Access represents the intermediate tier, enabling approved penetration testing activities. Teams at this level can examine systems they have authorization to probe, including infrastructure supporting essential services.

Specialized Access sits at the top with minimal restrictions. This tier serves organizations collaborating with federal authorities to evaluate systems like electrical grids, aviation controls, and financial transfer platforms.

The company emphasized that operations potentially causing physical damage or widespread disruption remain prohibited across all tiers, including the most permissive level.

Current Project Glasswing participants will automatically transition to Specialized Access status without requiring new applications for existing model versions.

Growing Alarm Over Digital Threats

This accessibility expansion follows mounting anxiety from industry leaders regarding AI’s cybersecurity implications. JPMorgan Chase’s Jamie Dimon stated that Mythos multiplied worldwide digital security risks by ten times.

Last August, federal officials announced plans to partner with commercial entities on overseas cyberattack operations, broadening responsibilities previously concentrated within government.

The company conducted evaluations to assess safeguard effectiveness across each tier. Outside the program, every attempted task faced immediate termination.

Within the Defense Access level, 46 out of 50 experimental attempts encountered blocking at some stage. The Red Team Access tier saw zero trial blockages.

Organizations working with Claude Mythos discovered more than 129,000 confirmed software vulnerabilities spanning April to July 2026, according to Anthropic. Above 33,000 received critical or high-severity classifications.

Internal scanning conducted by Anthropic identified an additional 5,500 flaws from April through October 2026. The company acknowledges actual figures likely exceed reported totals significantly.

This autumn, Anthropic intends to introduce Enterprise Frontier Safeguards—a framework enabling organizations to maintain private data storage while permitting company oversight for abuse detection.

Before that framework becomes operational, entities operating under zero data retention contracts may participate while maintaining existing privacy protections. The company committed to continuous safeguard refinement.