Anthropic folds Project Glasswing into a three-tier Cyber Verification Program for security teams
Access to offensive-capable AI is becoming a credentialed privilege rather than a product feature. Security leaders should expect vendor and partner due diligence to include which verification tier a provider holds. Critical infrastructure operators should plan for a sharp rise in the number of vulnerabilities disclosed against their software estates. Remediation capacity, not discovery, will become the binding constraint.
What Happened
On 6 October 2026 Anthropic announced an expanded Cyber Verification Program with Defense, Red Team and Specialized tiers. The program gives qualifying security professionals access to Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and later models with reduced blocking classifiers, and it absorbs Project Glasswing. The Specialized tier is limited to organisations testing safety-critical systems such as power grids, flight operating systems, telecom networks and interbank transfer infrastructure, which Anthropic vets jointly with the US government. Anthropic says Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026, more than 33,000 of them critical or high severity.
Why It Matters
Access to offensive-capable AI is becoming a credentialed privilege rather than a product feature. Security leaders should expect vendor and partner due diligence to include which verification tier a provider holds. Critical infrastructure operators should plan for a sharp rise in the number of vulnerabilities disclosed against their software estates. Remediation capacity, not discovery, will become the binding constraint.
Sources
- Anthropic (opens in a new tab): Expanding the Cyber Verification Program (2026-10-06)
- Quartz (opens in a new tab): Anthropic expands cyber AI access program to more security firms (2026-10-06)
More From This Briefing
- Google contracts 3.6GW from Constellation in PJM, funding $4.3bn of nuclear uprates
- CISA adds actively exploited Citrix NetScaler flaw CVE-2026-88779 to KEV with a three-day deadline
- OpenAI begins text watermarking to meet EU AI Act machine-readable marking rules
- BMA says insurer boards remain accountable for private credit even when management is outsourced
This story is part of the Laurenceo Intelligence briefing for 7 October 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.