Anthropic Merges Project Glasswing Into a Three-Tier Program Giving More Security Teams Claude's Full Hacking Toolset

Anthropic said Oct. 6 it is merging Project Glasswing -- the vulnerability-hunting research effort it launched in April -- into a single, three-tier Cyber Verification Program that gives more outside security teams access to Claude's full, otherwise-restricted hacking capability. The three tiers run from Defense Access (incident response, malware analysis, vulnerability research) through Red Team Access (authorized penetration testing) up to Specialized Access, reserved for vetted organizations testing systems like power grids, flight operations, and interbank transfer networks.

The same capabilities that enable a security team to find and fix a vulnerability can also help a malicious actor exploit it.

The numbers behind the merger are substantial. Since April, Project Glasswing's roughly 50 partner organizations -- including Cloudflare, Mozilla, Palo Alto Networks, Microsoft, Oracle, and Cisco -- have confirmed at least 129,000 verified software vulnerabilities using Claude Mythos models. Anthropic's own scanning of more than 1,000 open-source projects found another 5,500 verified vulnerabilities between April and October. Combined, over 33,000 of those findings are rated critical or high severity, and Anthropic says it believes the true number is at least five times higher than what's been reported.

Getting into any tier still takes real review. Defense Access applications are evaluated in a few days; Red Team Access, which unlocks offensive testing, takes a few weeks. Specialized Access has no fixed timeline at all -- Anthropic says it reviews every applicant "in depth in collaboration with the US government," and organizations already inside Project Glasswing move into it automatically, without reapplying.

Those are Anthropic's own figures, assembled from partner disclosures and its own scanning, not an outside audit. Some of the specific finds are independently checkable: Mozilla has confirmed 271 Firefox vulnerabilities surfaced this way -- ten times what its own prior testing caught -- and Cloudflare has reported roughly 2,000 bugs, 400 of them high or critical severity, with a false-positive rate it says beats human testers. A wolfSSL certificate-forging flaw tracked as CVE-2026-5194 is among the disclosed, patched results.

A separate, real-world measure cuts against the worst-case reading of a model that can both find and potentially enable attacks: of 300 vulnerabilities this work discovered and disclosed, Anthropic says only two were later found exploited in the wild before a patch landed -- a Ghost CMS SQL-injection flaw (CVE-2026-26980) and a Rejetto HTTP File Server session-forgery bug (CVE-2026-61500), a 0.67% in-the-wild rate the company cites as evidence its disclosure pipeline is outrunning attackers rather than arming them. Without any Cyber Verification Program access at all, Anthropic says Claude blocks cyber-related requests on the first prompt, every time -- the baseline every tier above Defense Access is measured against.

Of the vulnerabilities flagged, 530 high-or-critical bugs have been formally reported to software maintainers, 75 of those are already patched, and 827 more confirmed findings are still working through disclosure -- a queue Anthropic attributes partly to 90-day coordinated disclosure windows and partly to open-source maintainers who've asked it to slow down because they're capacity-constrained. (A 90-day disclosure window is standard security practice, not evidence of delay by itself -- the number worth watching is whether the 827 pending disclosures clear in roughly that window or keep growing.)

The access expansion is also a competitive move, not only a research update. Four days earlier, Google began routing its new Gemini 4 Argon model's full cyber capability -- guardrails off -- to the 650-plus vetted organizations in its Fairwind Program, including CrowdStrike and Palo Alto Networks. OpenAI's Astra crossed its own self-declared "Critical" cyber-capability threshold in September. All three labs are now running some version of the same bet: that a hacking-capable model is safe enough to hand to vetted outsiders before it's safe enough to release generally.

Every tier assignment in the new program rests on a test Anthropic designed, ran, and scored itself. Its CyScenarioBench evaluation found Defense Access blocked 46 of 50 attempted misuse scenarios, while Red Team Access -- the tier with real penetration-testing capability -- completed 34 of 50 offensive tasks with zero blocks, a 67.6% completion rate on tasks the same evaluation blocks entirely for an unverified user. No outside evaluator ran that test or checked the scoring.

Anthropic does name real partners -- Booz Allen and Comcast both appear on the record using Claude Mythos models for their own codebases, giving outside parties someone to actually ask. That's a meaningfully more open posture than a closed internal benchmark. But the practical effect of Oct. 6 is that a hacking-capable AI model most people still can't use at all is now available, guardrails off, to a wider list of organizations Anthropic itself vets, against a safety record Anthropic itself produced -- the same structure Google and OpenAI are each running under their own names, days apart.