Anthropic Expands Claude Access for Cybersecurity Teams After Discovering 129,000 Software Vulnerabilities
Anthropic expands Claude AI access for cybersecurity teams after Project Glasswing identifies over 129,000 verified software vulnerabilities, including thousands of critical and high-severity flaws.
Anthropic has expanded access to its advanced Claude AI models for verified cybersecurity professionals, following the discovery of more than 129,000 software vulnerabilities through its Project Glasswing initiative.
The announcement highlights the growing role of artificial intelligence in vulnerability discovery, incident response and authorized penetration testing.
Project Glasswing Discovers Thousands of Security Flaws
According to Anthropic, Project Glasswing identified at least 129,000 verified software vulnerabilities between April and July 2026.
The company also reported an additional 5,500 verified vulnerabilities through open-source scanning activities conducted between April and October 2026.
More than 33,000 of the verified vulnerabilities were classified as high or critical severity.
Anthropic noted that these figures may underestimate the initiative's actual impact because they were collected from only a subset of participating organizations.
New Cyber Verification Program Offers Three Access Levels
Anthropic has expanded its Cyber Verification Program (CVP), allowing vetted cybersecurity professionals to access powerful AI capabilities with different levels of security restrictions.
The program includes three access tiers:
| Access Level | Intended Purpose |
|---|---|
| Defense Access | Incident response, malware reverse engineering and vulnerability analysis |
| Red Team Access | Authorized penetration testing and security assessments |
| Specialized Access | Advanced security testing by selected verified organizations |
Eligible participants can access models including Claude Opus 5.5, Claude Sonnet 5.5 and Claude Mythos 5.1, subject to their approved access level.
The program is designed to make advanced AI capabilities available to legitimate security teams while managing the risks associated with their potential misuse.
AI Models Demonstrate Advanced Cybersecurity Capabilities
Anthropic evaluated its security controls using a cybersecurity benchmark called CyScenarioBench.
During testing, Claude Opus 5.5 operating under the Defense Access tier blocked 46 out of 50 evaluated tasks.
Under the Red Team Access tier, the same model completed 34 out of 50 tasks without blocking them.
These results demonstrate how different security restrictions can influence the capabilities available to verified cybersecurity professionals.
AI-Discovered Vulnerabilities Are Not Always Exploited
Despite the large number of vulnerabilities identified, research suggests that only a small proportion of examined flaws have been exploited in real-world attacks.
A VulnCheck analysis of 300 vulnerabilities associated with Anthropic and Project Glasswing found that only two had documented exploitation activity.
These included:
- CVE-2026-26980: SQL injection vulnerability affecting Ghost CMS.
- CVE-2026-61500: Session forgery vulnerability affecting Rejetto HTTP File Server.
The findings demonstrate that identifying a vulnerability does not necessarily mean it has been exploited or presents an immediate critical threat.
What This Means for Cybersecurity Teams
AI-powered security tools could significantly improve several cybersecurity operations, including:
- Automated vulnerability discovery and validation
- Malware analysis and reverse engineering
- Security incident investigation
- Authorized penetration testing
- Source-code security reviews
- Threat detection and response
However, organizations must also consider the risks associated with AI-generated findings, including false positives, inaccurate remediation recommendations and insecure AI-generated patches.
Security Takeaway
Anthropic's expanded Cyber Verification Program represents another step toward integrating advanced artificial intelligence into cybersecurity operations.
While AI can accelerate vulnerability discovery and security testing, human verification, responsible disclosure and secure remediation remain essential.
Organizations should focus on using AI to support experienced security professionals rather than relying entirely on automated vulnerability assessments.\
Related reporting
Weekly Cybersecurity Recap: Atlassian Exploits, Helpdesk Zero-Days, Rogue Certificates and ShinyHunters Arrests
Weekly cybersecurity recap covering Atlassian CVE-2026-21589 exploitation, Zammad zero-days, ShinyHunters arrests, rogue Google certificates, DarkSword malware and emerging AI security threats.
Hackers Begin Exploiting Critical Atlassian Data Center Flaw Within Hours of Disclosure
Hackers begin exploiting critical Atlassian Data Center vulnerability CVE-2026-21589 within hours of disclosure. Eight products affected, with patches available.
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Execute Code Without Macro Warnings
Critical LibreOffice and Apache OpenOffice vulnerabilities allow malicious spreadsheets to execute Java code without macro warnings. LibreOffice users should update, while OpenOffice users should disable Java until a fix is released.