A team brings an AI engineer in to work the security backlog alongside feature work. The first two weeks go well: the agent reviews pull requests, explains a failing dependency, and drafts a patch for a known issue. Then the brief asks it to validate whether a reported vulnerability is actually exploitable. It stops, and it keeps stopping. Nothing is broken. The model is doing what its maker says it does.
Anthropic's announcement of October 6, 2026, expanding its Cyber Verification Program, states the position directly. Generally available models, including Claude Opus 5.5, Claude Fable 5.1 and Claude Sonnet 5.5, have conservative cyber safeguards that block most cyber work. The company says the intent is to limit what a malicious actor can do with the model while it works on reducing false positives for secure coding.
That is a product decision, not a fault report. The same page explains the reasoning: cybersecurity is dual use, and the capability that lets a defender find and fix a vulnerability is the capability that lets someone else exploit it.
The announcement is specific about ordinary work, which matters more than the restriction for most teams. General models can keep being used for:
If that list covers the security work in your backlog, the gate never touches you. The practical test is not "does our AI engineer do security", but "which of these four verbs describes the task". Review, patch, scan your own code, or sort alerts: proceed. Validate exploitability, reverse-engineer a sample, run incident response, or test an outside system: read on.
The program moved from two overlapping programs into one set of access tiers. Each carries different verification requirements and security controls.
Two operational details sit inside that table. Enrolled organisations must accept data retention, because the program monitors for misuse; zero data retention for these tiers depends on a separate solution the announcement says is coming later in the fall, or on having access to a specific model tier with zero data retention today. And even Red Team Access keeps real-time blocks on actions that could cause physical harm or mass disruption.
Anthropic published the measurements behind its tiering, which is rare enough to be worth reading closely. It ran Claude Opus 5.5 through CyScenarioBench, ten multi-stage offensive challenges with five attempts each per tier, and reported:
The company's own reading is that it would expect significant blocks in Defense Access on this evaluation, because the scenarios are interactive and offensive. Take that at face value the other way too: buying access does not buy capability. The tier that removes the blocks reaches the same completion rate as an unrestricted model on this benchmark, no better.
Write the security scope as a scope, not an aspiration. A plan that says "the agent handles security" fails at the first validation task. A plan that says "the agent reviews pull requests, patches known issues, scans our source and triages alerts, and a person owns validation" is deliverable on day one. This is the same discipline as writing the spec before the build, covered in spec-driven development with AI agents.
Decide early whether the work needs a tier, because the review clock is days for Defense Access and weeks for Red Team Access, and the data retention condition is a procurement decision rather than a technical one. A team that discovers the requirement mid-sprint has lost the sprint. Requirements discovered late are the expensive kind, which is the same failure mode described in secure deployment is the real barrier.
Keep a person on the finding, not just the fix. A vulnerability the agent found and patched still needs someone to accept the risk that the patch is complete. The gate belongs on the action, following the pattern in gating risky tool calls, and the roles belong in the record, as set out in bounded permissions and human approval.
Plan for the agent to be wrong out loud. A blocked task is visible and cheap; a task the agent cannot do but attempts anyway is neither. The distinction between an agent that stops and one that improvises is the reason code written by an agent needs review, and it is why the rollout decisions in an enterprise Claude Code rollout are made before the first sprint rather than during it.
If your agents read documents, qualify leads, chase invoices or answer customers, none of this applies. The safeguards gate cyber work, and a back-office agent does not do cyber work. Teams that never ask a model to validate a vulnerability, analyse a sample or test an outside system will never meet the gate, and should not spend a meeting on it.
Yes. The announcement lists code review, patching known issues, vulnerability finding in owned source code and triage of security alerts as work the generally available models can continue to do. Those are the tasks most teams actually need.
Validating vulnerabilities is named as defensive work under Defense Access, and the general models block most cyber work, so plan on the application rather than on a workaround. Review time is quoted in days for that tier.
Yes. Red Team Access adds authorised penetration testing and red teaming to the defensive uses, and it is limited to organisations rather than individual researchers. Review is quoted in weeks, and real-time blocks stay in place for actions that could cause physical harm or mass disruption.
Data retention. Enrolled organisations accept it so the program can watch for misuse. Zero data retention for these tiers depends on a solution the announcement says is coming later in the fall, or on access to specific model tiers that already allow it.
Maxpertise embeds AI engineers inside existing engineering teams and runs managed AI teams for small and mid-sized businesses. Work is spec-driven with two human gates: a person approves the plan, and a person reviews the result. Nothing is automated until it has been proven by hand.
Constrained model access is a planning input to that method, not an obstacle to it. The how it works page sets out the two gates and the delivery shape, and the engagement options and what each includes are on pricing. If your backlog mixes routine review with validation or testing work, say so at contact and the plan can put the gated work behind the right access rather than discovering it mid-sprint.
[1] Anthropic, Expanding the Cyber Verification Program, October 6, 2026. Safeguards on generally available models, the tasks that remain available, the three access tiers and their review times, the CyScenarioBench results, and the data retention condition.
[2] Anthropic, Real-time cyber safeguards on Claude Opus and Sonnet, accessed October 9, 2026. How the safeguards present to a user.
[3] Anthropic, Cybersecurity solutions, accessed October 9, 2026.
[4] Anthropic, Enterprise Frontier Safeguards registration, accessed October 9, 2026. The data residency option referenced in the announcement.
Maxpertise is an AI-native engineering company. We embed native AI engineers inside your team, live in about 10 days. Please enable JavaScript to view the site, or email contact@maxpertise.net.