In cybersecurity, frontier AI models present a classic dual-use dilemma: the exact same capabilities that enable defenders to analyze malware, reverse-engineer binaries, and spot software vulnerabilities can also be leveraged by adversaries to automate exploits and streamline attack chains.
Anthropic took a major step toward balancing this equation by launching its expanded Cyber Verification Program (CVP). The initiative consolidates Project Glasswing, a cross-industry cybersecurity initiative designed to find and patch critical software vulnerabilities before they can be exploited and other previous verification efforts into a structured framework, giving vetted security professionals access to flagship models - including Claude Opus 5.5, Claude Sonnet 5.5, and Claude Mythos 5.1 - with reduced defensive safeguards and blocking classifiers.
While granting defenders unthrottled AI capabilities is a welcome shift, Anthropic's accompanying data highlights an operational reality: AI is discovery-heavy but remediation-poor.
What Is the Cyber Verification Program (CVP)?
Standard public AI models operate under strict safety guardrails. When a security researcher asks a commercial LLM to evaluate an exploit path or generate a specialized red teaming payload, the model's safety classifiers typically refuse the request.
CVP solves this by replacing blanket refusals with a verified, multi-tiered authorization model:
The difference in performance across these tiers is vast. On the CyScenarioBench benchmark - which evaluates multi-stage cyber operation capabilities - public Claude Opus 5.5 models blocked 100% of tasks on the first prompt. Under the Red Team Access tier, safety blocks dropped to 0%, enabling the model to achieve a 68% task completion rate (identical to running the unconstrained base model).
Crucially, safety restrictions aren't entirely removed. Anthropic retains automated guardrails across all tiers to block active ransomware deployment, physical system destruction, or unauthorized targeting of high-risk safety infrastructure.
The Glasswing Data: 129,000 Flaws and the Noise Problem
Alongside the program launch, Anthropic shared telemetry from its older Project Glasswing initiative. Between April and July 2026, Glasswing partners using Claude uncovered over 129,000 verified software vulnerabilities, with an additional 5,500 open-source vulnerabilities identified through automated scanning. Over 33,000 were rated as high or critical severity.
On paper, finding 129,000 software bugs in four months looks like a triumph for AI-driven defensive security. However, analyzing the broader security ecosystem reveals two major friction points:
1. The Exploitation Disconnect
An analysis conducted by VulnCheck researcher Patrick Garrity evaluated 300 vulnerabilities reported through Anthropic and Glasswing. Out of 300 bugs, only 2 (0.67%) were actively exploited in the wild (an SQL injection flaw in Ghost CMS and a session forgery vulnerability in Rejetto HTTP File Server).
While finding zero-days before attackers do is valuable, AI models are generating a massive volume of low-exploitability noise. For already-stretched AppSec teams, triaging tens of thousands of theoretically valid bugs that pose minimal operational risk can quickly consume limited engineering resources.
2. The AI Patching Paradox
If AI can discover 129,000 vulnerabilities, can't it simply write the patches?
Data from Veracode indicates that AI code generation tools are creating new vulnerabilities almost as fast as they find existing ones. In benchmark testing, 44% of AI-generated code fixes introduced secondary security risks, leaving the average security pass rate for AI-generated code flat at ~56%.
Using AI to automatically discover and patch bugs without strict human oversight risks exchanging known flaws for newly generated logic errors. AI may automate code generation but it still requires a human in the loop for code review.
What This Means for Security Operations
Anthropic's decision to provide vetted defenders with unthrottled AI tools reflects a realistic understanding of the threat landscape: threat actors will use unrestricted models, so defenders cannot be tied to restricted tools.
For enterprise security leaders, this transition introduces three key action items:
1) Shift focus from vulnerability volume to reachability.
The capability to scan repositories using advanced models like Claude Mythos 5.1 will flood SOC and AppSec queues with thousands of potential findings. Security teams must prioritize exposure and runtime reachability over raw vulnerability counts. Again, we see that AI is great at discovery but not yet on resolution.
2) Establish strict validation for AI-assisted remediations.
Given the 44% defect rate in AI-generated fixes, security teams should never commit automated LLM patches directly to production without mandatory peer review and automated regression testing.
3) Log and audit dual-use AI interactions.
Anthropic requires data retention and monitoring for CVP participants to prevent operational abuse. Organizations deploying LLMs for internal red teaming or vulnerability management must establish clear internal auditing to maintain regulatory compliance and prevent security tool exposure.
The Broader Industry Lesson
Anthropic’s new Cyber Verification Program marks an important shift in how AI vendors approach defensive enablement. By removing generic refusal filters for verified practitioners, Anthropic gives red teams and defenders the operational freedom required to test complex enterprise environments.
However, finding vulnerabilities at scale is only the first step. As AI accelerates vulnerability discovery into the hundreds of thousands, the real competitive advantage for enterprise security will not be how fast an LLM finds a flaw, but how efficiently human operators can verify, prioritize, and remediate the risks that actually matter.
Sources:
.png){kind=small}
