A hospital analyst investigating suspicious software and a testing firm probing an application may both need capable AI. Their jobs still raise different access questions. Finding a defect, reproducing an attack and testing a safety system are different assignments, even when all three aim to prevent harm.
Anthropic expanded its Cyber Verification Program on October 6, 2026. The useful question is which work a grant permits, who can hold it and what conditions follow approval. This article reflects the documentation checked on October 17; requirements can change.
Match the tier to the assignment
Anthropic’s program announcement describes three tiers:
| Tier | Work covered | Access boundary |
|---|---|---|
| Defense Access | Incident response, malware analysis and vulnerability validation | Includes qualifying individual researchers |
| Red Team Access | Adds authorized adversarial testing | Organizations only; blocks remain for physically harmful or widely disruptive actions |
| Specialized Access | Testing sensitive safety systems | Limited verified organizations; new applicants receive in-depth review with the US government |
The thumbnail’s three gates illustrate these distinctions. They are not a picture of an actual verification facility.
Two permissions to keep separate
Consider a fictional hospital with three proposed projects. First, its analyst wants to understand suspicious software found on a workstation. Second, an outside firm wants to test the hospital’s appointment application. Third, engineers want to probe a system whose failure could endanger patients.
These are examples for interpreting the categories, not reports of real engagements or promises that an application will qualify. Start by writing the assignment down: the system, its owner, the intended activity and the permitted limits. “We improve hospital security” leaves too much unspecified.
A model provider’s access decision answers one question: may this account use a capability under these conditions? The system owner’s permission answers another: may this team test this system within this scope? A grant cannot stand in for the second permission. Anthropic’s Usage Policy prohibits unauthorized compromise and allows authorized security research subject to its conditions and applicable law.
This distinction also matters after a refusal. The policy says a real-time block does not by itself establish a policy violation. An interrupted legitimate task and a prohibited task can produce a similar visible result. The surrounding facts still matter.
Approval has a narrower business scope than you might expect
The current Help Center guidance says individuals can apply for Defense Access on a paid plan. Organizations submit one application; administrators allocate access rather than having each employee apply separately. Approval can later be narrowed or withdrawn.
A separate boundary concerns services for customers. The guidance says a CVP grant covers work on an organization’s own code, products and infrastructure. Running the model against customer systems, exposing it through a customer-facing tool or otherwise productizing access requires separate application and approval.
For the fictional testing firm, two questions therefore belong on the planning sheet: does its tier cover the proposed activity, and does it have approval for the customer-facing use? Being an eligible security firm does not resolve both automatically. Ordinary public access also remains useful for secure code review, patching known problems, vulnerability finding in owned source code and alert triage.
The account is part of the security boundary
The security requirements require identifiable users and prohibit shared sign-ins. Defense Access requires multi-factor authentication immediately. By December 15, 2026, its accounts must use phishing-resistant authentication, and long-lived static credentials must give way to the required short-lived access methods.
For that deadline, an authenticator-app code is not equivalent to a passkey or security key. The requirements explicitly exclude SMS, emailed codes, authenticator-app codes and push approvals from the phishing-resistant category. New Red Team users already face phishing-resistant authentication and short-lived credential requirements at access time.
These controls address a different failure from a misleading prompt. Verification concerns who qualifies; account protection concerns who actually uses the approved account. A careful application review loses much of its value if someone can borrow a shared session. Treat the grant as an operating arrangement with named people and maintained controls, rather than a badge earned once.
Privacy depends on where activity records live
Individual Defense traffic is retained and monitored, with no zero-data-retention option, according to the security requirements. Organizations also generally face retention, although the Help Center describes interim exemptions for existing Fable or Mythos arrangements.
Anthropic’s proposed Enterprise Frontier Safeguards would let eligible customers store monitoring data in cloud infrastructure they control. Automated systems would examine activity across interactions, while flags would go to the customer’s own reviewers. The announcement describes a phased rollout starting later in fall 2026; it does not establish that a particular applicant already has it.
Keeping records in a customer’s cloud account still means records exist. For a security team handling proprietary code, useful follow-up questions include who can read those records, which keys protect them and who must act on a flag. Provider retention and customer custody describe different arrangements; neither phrase alone answers the whole privacy question.
Read the benchmark as a bounded experiment
Anthropic reports five attempts on each of ten CyScenarioBench challenges per access level:
| Access in the reported test | Trials blocked | Trials completed |
|---|---|---|
| Ordinary | 50 of 50, at the first prompt | 0 of 50 |
| Defense | 46 of 50 | 4 of 50 |
| Red Team | 0 of 50 | 34 of 50 |
The Red Team row is especially useful to read carefully: removing the blocks did not make every trial succeed. The comparison supports a narrower observation that adjusted safeguards changed what the model could attempt and complete in this test.
Irregular’s benchmark account describes private, containerized scenarios involving multi-stage decisions and realistic constraints. Its separate capability evaluation ran with cyber mitigations disabled. Irregular explicitly cautions that capability scores should not be read as real-world attack effectiveness.
Irregular built the benchmark; that does not make Anthropic’s subsequent tier comparison an independent audit. Nor does a blocked benchmark trial count as a prevented real attack. The experiment leaves questions about stolen accounts, missed misuse and legitimate work interrupted by safeguards.
For the next step in that reasoning, follow a vulnerability from early AI access to an installed patch. Access can enable investigation. Evidence that a system became safer still has to follow the work through verification and repair.
