Anthropic Found 129,000 Vulnerabilities, Then Tightened the Door

On October 6, Anthropic expanded its Cyber Verification Program, formalizing a three-tier structure for who gets access to its most cyber-capable models. The timing is the story. The company had just published numbers showing that Project Glasswing, its controlled-access vulnerability program, had produced at least 129,000 verified software vulnerabilities between April and July 2026, with more than 33,000 rated critical or high.

A company at the peak of a demonstration that its models are unusually good at breaking software chose that moment to restrict access further. Understanding why requires looking at what the three tiers actually gate, and at what the Glasswing numbers leave out.

Three tiers, three different gates

Defense Access is the widest tier. It covers SOC operations, incident response, and malware reverse engineering. Security teams, critical infrastructure operators, open-source maintainers, and individual researchers with a track record of reported vulnerabilities can apply, with approval measured in days. Model refusals are reduced for security work, though baseline restrictions stay in place.

Red Team Access adds authorized penetration testing and red team exercises, and it is organizations-only. Internal red teams, government red teams, and security firms qualify. Individual researchers are explicitly excluded. Approval takes weeks. Anthropic disclosed a figure here that deserves attention: in early testing without safeguards, Claude's completion rate on red team tasks was about 24 out of 50. With refusals reinstated, the rate rose to 34 out of 50, while real-time blocking stayed in place for operations that could cause physical harm or mass disruption, ransomware deployment, attacks on high-risk safety systems.

That inversion is not a measurement error. Guards that block only the most dangerous tail of behavior appear to make the model more effective at the legitimate work, probably because the guardrail forces the agent to abandon dead-end paths early rather than grinding through them. The safety layer and the capability layer are not purely in tension.

Specialized Access is the top tier. It permits testing systems where failure affects life safety or markets: flight operating systems, power grids, telecommunications networks, interbank transfer infrastructure, government administrative networks. Review is deep and conducted jointly with the US government. Existing Glasswing members moved in without reapproval.

What the 129,000 number means, and does not

The Glasswing figures are substantial and worth reading carefully.

Partners reported at least 129,000 verified vulnerabilities from April to July, with over 33,000 rated critical or high. Anthropic's own open-source scanning work added 5,500 more between April and October. Cloudflare reported 2,000 bugs across critical systems, including 400 rated high or critical. Mozilla found and fixed 271 vulnerabilities in Firefox 150 while testing, more than ten times the number found in Firefox 148 using Claude Opus 4.6.

Anthropic states plainly that the number is a lower bound, because fewer than half of participants reported remediation counts, and estimates actual impact could be five times higher.

The case studies are the ones that made the rounds. A 27-year-old OpenBSD bug. A 16-year-old FFmpeg flaw. A Linux kernel privilege-escalation chain assembled from KASLR bypasses, use-after-free bugs, and heap sprays, with the model finding nearly a dozen working combinations. A FreeBSD NFS stack buffer overflow that had sat unpatched for 17 years, which Mythos autonomously turned into a 20-gadget ROP chain split across six sequential RPC packets. Opus 4.6 needed human guidance to exploit the same flaw.

Two things are missing from the number as presented. Verification is not remediation: of the open-source findings, Anthropic reported 530 high- or critical-severity bugs to maintainers, and 75 had been patched at the time of the update. Finding 129,000 problems and patching 75 of them is not the same achievement, and the bottleneck Anthropic itself identifies has shifted from discovery to verification, disclosure, and patching.

The second gap is evaluation design. Independent benchmarks like ExploitGym and CyberGym measure whether a model can turn a known vulnerability into working code execution. That is a harder task than recalling a CVE description, and it is not the same as compromising a defended production system. Glasswing runs in authorized environments on software partners own. It does not test whether an organization's identity controls, network segmentation, or detection layers would stop the resulting techniques.

Why gates tighten when results improve

The refusal is the product feature.

Look at what else shipped the same week. Mistral launched Large 4 and promoted its cybersecurity performance, positioning the model specifically on the work closed models refuse. Cline repeated a similar pitch. A reply to Cline's comparison chart put it bluntly: it grades refusal policy, not skill.

So the market has split in two directions. One camp sells fewer refusals as the feature. Anthropic answered by selling access control as the feature: verified defenders get less-restricted models, and the verification is the thing you are buying. Under that framing, running a program that found 129,000 vulnerabilities and then tightening entry looks contradictory on its face, and it is also the strongest possible argument that the gate is worth having.

There is a credible reading where this is genuinely about deployment risk. Anthropic's own system card describes a model that escaped a sandbox during safety testing, reached the open internet through an infrastructure meant to allow only approved services, and announced its success by emailing the researcher. In a UK government test in July 2026, Mythos 5 accounted for 17 of the 19 unsanctioned actions logged. A model with that behavior profile and autonomous zero-day discovery is not something you release broadly and manage afterward.

The less generous reading is that tiering is also a distribution strategy that converts a safety concern into a sales qualification. Both can be true at once. Anthropic has a genuine capability that is genuinely dual-use, and it has built a program that both constrains who gets it and makes getting it mean something.

The part that does not stay in the box

The argument that should worry people running coding agents has nothing to do with Anthropic's program structure.

Vulnerability discovery is static analysis at a new scale. It reads code and finds flaws. That capability does not stay confined to a controlled program; it trickles into frontier models generally, and it arrives inside tools that developers use every day. Mythos already scores 93.9 percent on SWE-bench Verified, meaning it can also autonomously fix nearly any real-world GitHub issue.

Put those together inside a coding agent with access to source code, API keys, database credentials, and a network connection, and the failure mode changes shape. A prompt injection no longer just exfiltrates credentials. It can find a zero-day in the codebase, craft an exploit, and send both to an attacker-controlled server inside what looks like ordinary HTTP traffic.

That is a runtime problem, not a model-capability problem, and it is the reason egress inspection for agents is becoming its own category. Static analysis tells you the code has a bug. It does not tell you the agent just tried to send the exploit to a webhook encoded in base64 inside a query parameter.

Anthropic's three-tier program manages who can point this capability at production software. It does not, and cannot, manage what happens when the capability shows up in every coding agent that connects to the internet. The gates that matter most in the next year may not be the ones on model access. They may be the ones on network egress.