Anthropic made two announcements in October 2026 that, taken together, say a good deal about where AI security products are heading.
On 6 October, the company merged Project Glasswing into an expanded, three-tier Cyber Verification Program (CVP), giving vetted security professionals access to Claude models with progressively fewer cyber safeguards.
Around 13 October, it struck a deal with Opaque Systems, a confidential computing startup, licensing its technology and hiring its CEO and CTO while Opaque winds down.
The first move loosens restrictions on capability. The second brings in-house the tooling used to prove what an AI system did. Neither is unusual on its own. The combination is worth examining carefully.
What happened: the Cyber Verification Program
The problem Anthropic says it is solving
Anthropic's generally available models, including Claude Opus 5.5, Sonnet 5.5 and Fable 5.1, ship with cyber safeguards that block most cyber work. The company's reasoning is that the same capabilities that help defenders find and fix flaws also help attackers exploit them.
That blanket restriction is a problem for legitimate security teams. Anthropic's stated position is that "defenders also need access to the best tools and most powerful capabilities to secure their systems."
The three tiers
The expanded programme merges two initiatives that ran separately for about six months: the original CVP, which reduced safeguards on Opus and Sonnet for vetted teams, and Project Glasswing, which gave organisations securing critical software access to Claude Mythos.
Tier | Who it is for | Review time |
|---|---|---|
Defense Access | SOC teams, incident response, malware analysts, open-source maintainers, individual researchers | A few days |
Red Team Access | Authorised offensive teams: in-house, government and penetration testing firms. Organisations only, individual researchers not eligible | A few weeks, with Defense Access granted in the interim |
Specialized Access | Verified organisations authorised to test safety-critical systems | Vetted in collaboration with the US government |
Specialized Access carries the fewest blocks. It is reserved for organisations cleared to test systems whose failure could harm people or disrupt markets: power grids, flight operating systems, telecom networks, interbank transfer infrastructure and government administrative networks.
Existing Project Glasswing members move into this top tier without reapproval for their current models. Across all tiers, participants may only test systems they are authorised to assess.
The models covered are Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1.
What Glasswing produced
Anthropic's case rests on output. It reports that Project Glasswing partners identified at least 129,000 verified software vulnerabilities between April and July 2026, with Anthropic's own open-source scans finding a further 5,500. More than 33,000 of those were rated critical or high severity.
Glasswing consisted of a tightly vetted group of more than 40 companies, reported to include Amazon, Apple, Microsoft, Google, the Linux Foundation, JPMorganChase and Nvidia.
The number Anthropic published that critics will use
To its credit, Anthropic published evaluation data showing what reduced safeguards actually mean in practice. On one evaluation at the Red Team Access tier, no blocks occurred, and Claude Opus 5.5 completed 34 of 50 tasks. Anthropic describes this as effectively equivalent to the model's 67.6% success rate on the same evaluation with no safeguards applied at all.
That is a transparent disclosure and it is also a concession. For that evaluation, the middle tier performed as though the safeguards were simply switched off. The control sits in the vetting of who gets in, not in any residual technical limitation on what they can do once inside.
What happened: the Opaque Systems deal
The structure
This is being widely reported as an acquisition, and the framing matters.
Several outlets, including Constellation Research, describe it as an acquihire: Anthropic licenses Opaque's technology and hires part of the team, with financial terms undisclosed. Opaque's own website states its team is joining Anthropic and that the company is winding down its operations.
Reporting conflicts on how much of the team moved. Some accounts say the team is joining; at least one says CEO Aaron Fulkerson, CTO Rishabh Poddar and some engineers were hired while most other employees were not included. That discrepancy has not been resolved publicly.
What Opaque built
Opaque originated as a research project at UC Berkeley's RISELab. Its founders include Ion Stoica, co-founder of Databricks and Anyscale, and Raluca Ada Popa, an encryption and systems security researcher now at Google DeepMind.
Its technology lets AI systems use sensitive data while keeping that data protected by the underlying hardware, an approach known as confidential computing. It raised a $24 million Series B at a $300 million valuation and partnered with Nvidia, Intel, Microsoft and Google.
More recently it expanded from confidential AI into verifiable AI: using cryptographic evidence to establish how systems executed and whether policies were followed. Its projects include the Agent Governance Toolkit, TRACE, Confidential MCP and the Weight Custody Manifest.
Anthropic was already an Opaque customer, alongside ServiceNow and Accenture.
The obvious criticism
The value of attestation tooling comes from its independence. It is useful precisely because it can check vendors.
If a model vendor controls the tooling that verifies its own models' behaviour, the independence that gave the verification its meaning is weakened. This objection has been raised directly in commentary on the deal and it is not easily dismissed.
There is a second open question. Opaque's work included open standards such as TRACE and the Agent Governance Toolkit, adopted in Europe and the UAE. Whether Anthropic will continue maintaining them, or let them drift once integration is complete, has not been addressed.
Why it matters
The dual-use problem is now being managed by access control rather than capability limits. Anthropic's own evaluation shows the Red Team tier behaving as though unsafeguarded on at least one benchmark. The security of the arrangement therefore depends on vetting, authorisation scoping and the honesty of participants, not on the model refusing anything.
Vetting at scale is the hard part. Defense Access reviews take days. The stated ambition is to extend Glasswing's impact to a much larger number of defenders. Scale and rigour pull in opposite directions, and the programme's credibility rests on the part that is least visible from outside.
Individual researchers sit awkwardly in this structure. They can get Defense Access but are explicitly excluded from Red Team Access, which is organisations only. A great deal of valuable security research is done by individuals.
Government involvement in the top tier is notable. Specialized Access applicants are vetted in collaboration with the US government. For a commercial AI product, that is a meaningful degree of state participation in deciding who may use a capability, and non-US organisations may reasonably ask what it means for them.
Confidential computing is becoming table stakes. Bringing the capability in-house rather than relying on a vendor signals that attestation and data isolation are becoming expected product features for regulated industries and sovereign deployments, not optional extras.
The two moves interact. Loosening cyber restrictions increases the need for credible evidence of how models were used. Acquiring the company that supplied that evidence does not, by itself, reduce that need. It changes who is attesting.
Who is affected
Security teams, SOCs and incident responders who previously hit safeguard refusals on legitimate work.
Penetration testing and red team firms, newly eligible as organisations.
Individual security researchers, who gain Defense Access but remain excluded from the red team tier.
Critical infrastructure operators in energy, aviation, telecoms, finance and government, who are the intended Specialized Access population.
Regulated enterprises evaluating confidential AI deployments, for whom the Opaque capability is the relevant development.
Opaque's existing customers, including ServiceNow and Accenture, and users of its open standards.
Everyone else, indirectly, since the premise of the programme is that vulnerabilities get found and fixed faster than they are exploited.
What organisations should do
If you are considering applying
Pick the tier that matches your actual work, not the most permissive one you might qualify for. Red Team Access requires demonstrable authorisation to test the systems you name.
Document your authorisation scope before applying. Across all tiers, you may only test systems you are permitted to assess, and that will be the basis of the review.
Expect the timelines quoted, a few days for Defense Access and a few weeks for Red Team Access, and plan work accordingly.
Note that approval is model-specific. Glasswing members carry over for current models, which implies future models may require fresh review.
If you are granted reduced safeguards
Build your own controls, because the model's are reduced. Logging, approval workflows and scope enforcement now sit entirely with you.
Keep an auditable record of what was tested and under whose authorisation. This is the evidence you will need if a test is ever questioned.
Treat access as a privileged credential. An account with reduced cyber safeguards is a valuable target, and should be protected like an administrative one.
If you are evaluating confidential AI
Ask who attests, and to whom. Where a vendor supplies both the model and the verification tooling, establish what independent assurance you actually have.
Check the status of the open standards you depend on, including TRACE and the Agent Governance Toolkit, before building on them.
Final thoughts
Anthropic's argument is straightforward and not unreasonable: blanket cyber safeguards block defenders along with attackers, and defenders are the ones who identified 129,000 verified vulnerabilities in four months. Lifting restrictions for people who can prove who they are and what they are authorised to test is a defensible response to a genuine problem.
The lesson for anyone building on these models: the safeguard is now the vetting process, not the model. Anthropic's published evaluation showed one tier performing as though unprotected. That is honest reporting, and it relocates the entire security question. It no longer asks what the model will refuse. It asks how good the approval process is, who sits on it, and what happens when someone approved turns out not to deserve it.
The second lesson concerns verification. Independent attestation is valuable because it is independent. When the organisation being verified acquires the verifier, something real is lost even if every individual involved acts in good faith. That is not an accusation, it is a structural observation, and the right response is for buyers of confidential AI to ask harder questions about who is vouching for what.
Two questions worth asking: if you hold reduced-safeguard access, what stops a compromised account in your organisation from using it, and if you rely on attestation tooling, who verifies the verifier?
