Project Glasswing: What It Is, Who's In and the Three Access Tiers

Here's the part most coverage skips: you don't need Glasswing for everyday security work. Anthropic says its generally available models still handle code review, patching known issues, finding vulnerabilities in source you own and triaging security alerts. The tiers are for work those models block.

Why Anthropic kept Mythos Preview back

Glasswing exists because of what Anthropic saw in an unreleased model. Claude Mythos Preview is a general-purpose model, but its coding ability could find and exploit software vulnerabilities better than all but the most skilled humans. Anthropic said it had already found thousands of high-severity vulnerabilities, including in every major operating system and web browser.

So Anthropic said it didn't plan to make Mythos Preview generally available. The goal was to build safeguards that detect and block the most dangerous outputs, and to test them first on an upcoming Claude Opus model that didn't carry the same level of risk. If you want the model itself rather than the access programme, my guide to what Claude Mythos is covers that.

Launch partners and the wider circle

Glasswing launched with twelve partners: Amazon Web Services, Anthropic, Apple, Broadcom, Cisco, CrowdStrike, Google, JPMorganChase, the Linux Foundation, Microsoft, NVIDIA and Palo Alto Networks. Anthropic then extended access to over 40 more organisations that build or maintain critical software infrastructure.

As announced in April 2026, Anthropic committed up to a hundred million dollars in usage credits across the effort and gave four million dollars to open-source security groups, split between Alpha-Omega and OpenSSF through the Linux Foundation, and the Apache Software Foundation. Once the credits ran out, Mythos Preview was to be offered to participants at a set token price through the Claude API, Amazon Bedrock, Google Cloud's Vertex AI and Microsoft Foundry.

The project page carries quotes from partner security leaders, including Cisco's Anthony Grieco, AWS's Amy Herzog, Microsoft's Igor Tsyganskiy, Google's Heather Adkins and the Linux Foundation's Jim Zemlin. CrowdStrike's Elia Zaitsev put the case most bluntly: with AI, the window between a vulnerability being found and exploited has collapsed from months to minutes.

The name comes from the glasswing butterfly. Anthropic's explanation is that its transparent wings let it hide in plain sight, like the vulnerabilities, and help it evade harm, like the transparency Anthropic says it's advocating.

Three old bugs the model found

Anthropic gave three examples, all reported and patched:

• A 27-year-old vulnerability in OpenBSD that let an attacker remotely crash any machine running it.
• A 16-year-old flaw in FFmpeg, in a line that automated tools had hit five million times without catching it.
• A chain of Linux kernel flaws that let an attacker escalate from ordinary access to full control of the machine.

Partners were expected to use the model for local vulnerability detection, black-box testing of binaries, securing endpoints and penetration testing. Anthropic also promised a public report within 90 days, with recommendations on vulnerability disclosure, software updates, open-source and supply-chain security, patching automation and standards for regulated industries.

October: Glasswing joins the Cyber Verification Program

For six months the two programmes ran side by side. Glasswing gave selected organisations access to Claude Mythos, while the Cyber Verification Program, or CVP, gave vetted security teams reduced safeguards on Claude Opus and Sonnet models. On 6 October 2026 Anthropic expanded the CVP and said it was integrating it with Glasswing into one offering.

The reason is that cybersecurity is dual use. Anthropic's generally available models, such as Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5, have conservative cyber safeguards that block most cyber work. Every CVP tier includes Claude Opus 5.5, Claude Sonnet 5.5, Claude Mythos 5.1 and new models going forward, and admins assign access to specific workspaces.

The three CVP access tiers compared

Tier	What it covers	Who qualifies	Review
Defense Access	Security operations, incident response, reverse-engineering malware, validating vulnerabilities	Security teams defending systems they own, critical infrastructure operators of any size, smaller security firms, open-source maintainers, individual researchers with a track record	Anthropic aims to respond within a few days
Red Team Access	Adds authorised penetration testing and red-teaming, only on systems you're authorised to test	Organisations only, such as in-house, government and penetration-testing teams	A few weeks, with Defense Access in the meantime
Specialized Access	Fewest cyber blocks, for testing safety systems that could affect lives or markets	A limited set of verified organisations; existing Glasswing members move here without reapproval for current models	In depth, with the US government

Anthropic's examples of Defense Access applicants include a regional hospital or a municipal utility, which tells you the bar isn't size. Red Team Access still keeps real-time blocks on actions that could cause physical harm or mass disruption, such as deploying ransomware. Specialized Access is for systems like flight operating systems, power grids, telecom networks, interbank transfer infrastructure and government administrative networks.

Data retention and Enterprise Frontier Safeguards

Enrolled organisations have to accept data retention so Anthropic can monitor for cyber misuse. A new option called Enterprise Frontier Safeguards is meant to combine zero data retention with safeguards, and it was due later in the fall of 2026. Until it arrives, organisations with Claude Fable 5.1 or Mythos 5.1 on zero data retention can use the CVP that way.

Platforms matter too. As of November 2026 the CVP is available on the Claude Platform, Google Cloud's Vertex AI and Microsoft Foundry. On Amazon Bedrock it's only for customers eligible for Enterprise Frontier Safeguards. Existing CVP members keep their settings for previous models and are automatically evaluated for the newer ones.

What Anthropic's tier tests showed

Anthropic tested the tiers with Claude Opus 5.5 on an evaluation called CyScenarioBench. The results show how differently the same model behaves depending on your tier:

• Without CVP access, every task was blocked on the first prompt.
• In Defense Access, 46 of 50 trials were blocked at some point.
• In Red Team Access, no blocks occurred and the model completed 34 of 50.

Glasswing results: 129,000 verified vulnerabilities

Anthropic reports that Glasswing partners found at least 129,000 verified vulnerabilities between April and July 2026, and that Anthropic's own open-source scanning found another 5,500 between April and October 2026. More than 33,000 of the verified ones were rated critical or high severity. Anthropic says that's likely an undercount, because it's based on reports from only some partners.

What a small firm should do about it

1. Check whether your general Claude model already covers the task. Code review, patching known issues and alert triage still work without applying.
2. If it's blocked, decide which tier matches your scope.
3. Apply on Anthropic's CVP page and be ready to show your security controls.
4. Wait for verification: days for Defense Access, a few weeks for Red Team Access.
5. Ask your admin to assign access to the specific workspaces that need it.
6. If you're blocked on work you think your tier should allow, use Anthropic's report form. Full tier details are in its Help Center.

My advice for a small business or agency: don't apply just because the name's in the news. I'd use the general models for code review, patching and triage, and only apply when a real piece of defensive work gets blocked. If you do apply, remember that retention is part of the deal, so check that with whoever owns your data policy first.

Frequently asked questions

What is Project Glasswing?

It's Anthropic's initiative to secure critical software by giving selected organisations early access to Claude Mythos Preview. It was announced on 7 April 2026 with twelve launch partners, including AWS, Apple, Google, Microsoft and the Linux Foundation.

Is Claude Mythos Preview publicly available?

No. Anthropic said it didn't plan to make Mythos Preview generally available, and wanted to build and test safeguards on an upcoming Claude Opus model first.

How do I get access through Project Glasswing now?

Since 6 October 2026, Glasswing and the Cyber Verification Program are one offering with three tiers: Defense Access, Red Team Access and Specialized Access. Organisations apply on Anthropic's site.

Can individuals join the Cyber Verification Program?

Individual researchers with a track record of reported vulnerabilities can qualify for Defense Access. Red Team Access is for organisations only.

Does the Cyber Verification Program require data retention?

Yes. Retention is required so Anthropic can monitor for cyber misuse. Enterprise Frontier Safeguards, due later in the fall of 2026, is meant to combine zero data retention with safeguards.