LinkedIn publication text
Anthropic releases more powerful AI to teams that hunt flaws before hackers do
On Oct 6, 2026, Anthropic merged Project Glasswing and its Cyber Verification Program (CVP) into three access tiers: Defense, Red Team and Specialized. Verified teams can now use Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1 with fewer cyber blocks.
What my study of the announcement shows:
- 🔹 A ladder, not a switch: more permission demands more vetting and more controls.
- 🔹 The numbers: Glasswing partners found 129,000+ verified flaws (Apr–Jul) and Anthropic another 5,500; 33,000+ rated critical or high. Self-reported and partial.
- 🔹 The benchmark: at Red Team, Opus 5.5 completed 34 of 50 offensive tasks, the same level as the model with no safeguards.
- 🔹 The timeline: from Mythos Preview (Apr 7) to the unified CVP (Oct 6), including a suspension over U.S. export controls from Jun 12 to Jul 1.
- 🔹 Who gains: small defenders, pentest firms, open source.
- 🔹 Who loses: independent researchers (shut out of Red Team) and organizations outside the U.S. at the top tier, which is reviewed with the U.S. government.
For GRC, the lesson is clear: the control perimeter is no longer the model. It is identity, authorized scope and audit trail. For Brazilian organizations, mandatory data retention also raises data-protection (LGPD) and digital-sovereignty questions.
While checking the Brazilian press coverage against Anthropic's original announcement, I found three inaccuracies, detailed in the deck.
The defenders' window is short: Anthropic itself expects rival models with similar capability within 6 to 12 months.
What controls would your organization require before giving a security team offensive AI?