Can reduced AI safeguards give cyber defenders an advantage?

The answer is plausible for verified teams, but the public evidence is not yet independent

Anthropic has expanded access to cyber-capable versions of its models through a three-tier Cyber Verification Program. The practical case is straightforward: a safeguard designed to stop malicious exploitation can also interrupt an incident responder analysing malware or a maintainer validating a flaw in software they are authorised to test. The new system attempts to separate those users through identity checks, organisational verification, security requirements and activity monitoring rather than applying the same restrictions to everyone.

The release provides useful denominators, but it remains a company account of a company programme. Anthropic reports both a controlled evaluation of how often its safeguards block work and large totals for vulnerabilities identified by participating organisations. Neither dataset is presented as a peer-reviewed comparison with other tools or unaided teams. The evidence therefore supports a narrower conclusion: tiered access can materially change what the model is able to do, while the extent of the resulting security benefit and misuse risk still needs independent measurement.[1][2]

Three tiers trade wider defensive access for progressively stronger vetting

Defense Access covers security operations, incident response, malware reverse-engineering and vulnerability analysis. Anthropic says company, university, nonprofit and government security teams, critical-infrastructure operators, smaller security firms, open-source maintainers and individual researchers with a disclosure record may qualify. Red Team Access additionally permits authorised penetration testing. It is limited to organisations, and the model should still block actions capable of physical harm or mass disruption, including ransomware deployment and adversarial testing of high-risk safety systems.

Specialized Access removes the most cyber blocks and is reserved for a limited set of organisations authorised to test systems whose failure could affect lives or markets, including flight operations, power grids, telecommunications, interbank transfers and government networks. Anthropic says it reviews every such organisation in depth with the US government. That is a consequential governance choice: it may provide expert scrutiny, but the public materials do not specify decision criteria, appeal routes, international representation or how consistent judgments will be across jurisdictions.[1][2]

The 50-trial test shows the controls separate access modes

Anthropic tested Claude Opus 5.5 on CyScenarioBench, which contains ten interactive challenges intended to represent multi-stage cyber operations. It ran five attempts per challenge for each access setting, giving 50 trials per setting. Without programme access, all 50 trials were stopped on the first prompt. Under Defense Access, 46 of 50 were blocked somewhere in the challenge and four succeeded. Under Red Team Access, no safeguard blocks occurred and the model completed 34 of 50 tasks.

The company compares that 34-of-50 result with a stated 67.6% completion rate when safeguards are absent, treating Specialized Access as representative of that condition. The comparison suggests the Red Team classifier did not materially suppress benchmark completion. It does not show that 34 operations improved a real organisation's security, nor does it measure false authorisations, analyst judgment, time saved, exploit reliability or downstream harm. Five attempts on ten scenarios are informative about the gate, but too small and controlled to establish a general safety-performance balance.[1]

The vulnerability total needs its denominator and patch status

For Project Glasswing, Anthropic says partners uncovered at least 129,000 verified software vulnerabilities between April and July 2026. Its own open-source scanning found another 5,500 between April and October. More than 33,000 were rated critical or high severity. Those figures are consequential if they represent distinct, valid findings that reached maintainers, because systematic discovery could help reduce risk across widely reused software rather than only inside well-resourced companies.

The published qualification is equally important. The partner total comes from 33 reports, organisations used different triage methods, and fewer than half of partners disclosed how many vulnerabilities were patched. Anthropic describes the count as a lower bound and estimates total impact could be at least five times higher, but that extrapolation is not accompanied by a public sampling method or record-level dataset. Duplicate reports, severity calibration, false positives, disclosure timelines and fixes are not broken out. Finding a flaw is not the same outcome as safely remediating it.[1]

New evidence: disclosures rose in a non-random comparison, while measured exploitation did not

A 4 November economics preprint adds an independent observational analysis rather than another company total. Thomas Mosk assembled 177,104 public vulnerability records: 176,384 CVEs published between January 2024 and October 2026 plus 720 entries from a Chinese vulnerability database that lacked a CVE. The main panel compares 13 Glasswing firms—12 launch partners plus IBM—with 267 Chinese technology firms across October 2025 to September 2026, a balanced 3,360 firm-month dataset. The study also links 634,100 researcher-month observations and identifies 18,650 credited vulnerability researchers before launch.

Using a difference-in-differences design with firm and month fixed effects, the paper estimates that treated firms more than doubled disclosures after early access and disclosed roughly 150% more high-impact vulnerabilities relative to the Chinese comparison. Event-study coefficients before treatment were jointly insignificant at p=0.19, while the visible increase begins in March, when partners had early access ahead of the April launch. The author clusters standard errors and also applies an Ibragimov–Müller test across the 13 treated firms because the number of treated clusters is small. Those steps improve the analysis but cannot randomise which companies Anthropic selected.

External researchers reported about half as many vulnerabilities in treated firms' software and more in other firms' products, while the number of active researchers did not fall. The paper interprets this as effort moving when companies find more flaws internally. It also reports that the share of vulnerabilities exploited within one month of disclosure fell by about two-thirds, mainly because a smaller share was already being exploited at disclosure, while the number exploited did not change detectably. That pattern is consistent with defenders finding additional flaws before attackers, but public catalogs capture only known exploitation and cannot show whether undisclosed attacks or unreported vulnerabilities changed.

The comparison does not estimate AI versus no AI. Chinese firms could use Chinese and publicly available models, while selected US firms received the more capable restricted model. Disclosure rules, product mixes and reporting systems also differ by country. A supplementary comparison with 26 large non-Chinese firms ends in May, before the programme expanded to roughly 150 organisations in June, because expansion contaminates that group as a stable control. The study observes public disclosures and vendor remediation dates; it cannot count every flaw found, verify each patch or show whether customers installed fixes. Its estimates therefore strengthen the case that access changed defensive discovery, not the broader claim that net cyber risk definitely fell.[3]

People gain only when findings become fixes without creating new exposure

For maintainers and security teams, fewer false refusals could shorten the path from suspicious code to a reproducible report and patch. Smaller organisations may gain access to analysis that previously required scarce specialist time. People who rely on hospitals, utilities, financial transfers or public services benefit only if the programme produces validated fixes before attackers can exploit the same weaknesses. The absence of a complete patch denominator means the current announcement cannot quantify that public benefit.

Reduced blocking also increases the importance of credential security, audit trails and fast revocation. The programme requires data retention so Anthropic can monitor misuse, with limited zero-retention arrangements and a future Enterprise Frontier Safeguards option. Participants therefore face a second trade-off involving sensitive incident material and provider visibility. A compromised approved account, poorly scoped authorisation or weak internal handling could turn privileged capability into risk, particularly where testing touches operational technology or personal data.[1][2]

What would change the assessment

Confidence would rise with an independent audit that publishes a deduplicated vulnerability denominator, common validation and severity rules, false-positive rates, patch status, disclosure times and comparisons with teams using other tools or no advanced model. A prospective study should record analyst hours, compute and review costs as well as vulnerabilities found. For critical systems, evaluation should test whether access controls withstand stolen credentials, insider threats and ambiguous authorisation without disclosing exploit details that increase harm.

The safety case also needs longitudinal evidence: how many approved users are narrowed or removed, how often real-time monitoring identifies misuse, whether geographic eligibility is equitable and whether material incidents are disclosed. Until those measures exist, the strongest reading is balanced. Anthropic has shown that its tier settings change benchmark behaviour and has reported a large volume of partner findings. It has not yet shown, in independently reviewable evidence, the net reduction in cyber risk produced by opening those capabilities more widely.[1][2]