Anthropic opens Mythos to vetted outside users for the first time, merging CVP with Glasswing into three tiers for defense, red teaming and critical infrastructure

Anthropic announced a revamp of its Cyber Verification Program (CVP). For the first time, it will offer Claude Mythos to vetted external users. Until now the model had been used only inside Project Glasswing, the company's collaborative vulnerability-hunting effort. CVP and Glasswing will be combined into a single program, with users divided into three tiers: defense, red teaming and critical infrastructure.

What matters most about the announcement is its timing and the policy shift behind it. Anthropic had kept its most cyber-capable model from outside users because it can write exploit code. Yet right after a flaw found through Glasswing was actually weaponized, the company decided to release that model externally. In effect, it has moved from keeping dangerous capabilities locked away to distributing them with vetting at each tier of use and real-time blocking.

Mythos moves beyond Glasswing under a three-tier vetting system

The new CVP sorts users into three tiers by use case: defense, for organizations protecting their own systems; red teaming, for authorized testing from an attacker's perspective; and critical infrastructure. Each tier has its own vetting process that decides who can use Mythos. Usage is monitored, and misuse can be blocked in real time.

Until now, Mythos's capabilities reached the outside world only as vulnerability reports delivered through Glasswing. Anthropic kept the model itself in-house and passed only the vulnerability findings to the parties it disclosed them to. With the merger, vetted outside organizations will be able to run Mythos themselves. Anthropic is no longer controlling the output. It is controlling who uses the model and in what context.

The trigger: exploitation the day after disclosure

The immediate backdrop is the Rejetto HFS case. According to The Register (October 3), an authentication bypass flaw, CVE-2026-61500, found by Mythos through Glasswing, was exploited by the day after it was disclosed. The critical flaw can lead to remote code execution and has been fixed in HFS 3.2.1. It was disclosed on September 30. According to Patrick Garrity of VulnCheck, attacks on servers in the US and Japan from IP addresses that appeared to originate in China had begun by the evening of October 1. Mythos and Glasswing have found 286 CVEs to date, and according to the same report, this is the second one confirmed to have been exploited.

The case shows that locking the model away does not stop information about the flaws it finds from getting out. Exploitation followed disclosure in less than a day. If so, it makes more sense to give the same speed of discovery to the people applying the fixes. The vetted-access program can be read as the result of that reasoning.

Containment had already lost much of its value

Containment itself was already losing its effect. In a September 29 report, Anthropic's Frontier Red Team showed that Z.ai's open-weight GLM-5.3 fully developed working exploit code in 12% of attempts on ExploitBench. That is close to the 14% achieved by Mythos Preview. Using abliteration, which removes refusal behavior by modifying a model's weights, stripped out the safeguards 100% of the time. With comparable capabilities starting to circulate as open weights, attackers can obtain them whether or not Anthropic releases Mythos.

At the same time, Anthropic had only just explained in public why it was holding the model back. At a New York City Council hearing on October 5, Logan Graham, who leads the Frontier Red Team, testified under oath that Mythos Preview had not been released to the public because of its ability to write exploit code. The new CVP is consistent with that testimony in that it is still not a public release. What has changed is that Anthropic has dropped the binary choice between releasing and withholding in favor of a system that decides who gets access, and at which tier.

Turning the frontier labs' approach into a tiered program

Giving highly capable models only to defenders has become common across the industry. Google offers Gemini 4 Argon only through its Fairwind Program, which is limited to cyber defense professionals. OpenAI has split access between Daybreak Red, which requires an application, and Daybreak Blue, which is open to general users, and GPT-6.1 Sol was rated Critical for cyber under the company's own Preparedness assessment. Anthropic's announcement takes this approach a step further, formalizing it as a program with three use-based tiers and real-time blocking.

OpenAI has halted training and inference of its most capable model. Anthropic, meanwhile, has released Mythos externally with vetting. The two companies' approaches to handling dangerous capabilities have diverged more sharply than ever.

How to judge whether the program works

Whether this approach succeeds depends on whether the vetting and blocking actually work. There are three things to watch. First, whether any vetted user is linked to a case that leads to exploitation, as with Rejetto HFS. Second, whether Anthropic discloses how many cases it has blocked and what they were. Third, whether OpenAI's GPT-6 Cyber and the general release of Google's Fairwind arrive with similar vetting tiers. Will the shift from locking up models to managing how they are used really make defenders faster? The answer will come the next time a flaw found by Mythos is disclosed.