A great deal of the work I do is supported by Claude, directly or through tools that interact with Claude’s services. That includes querying packet captures, reverse engineering binaries, working through forensic artifacts and images, and building open source tooling, some of it designed to run on local models so self funded students and small teams aren’t priced out of enterprise level capability.
Update · Oct 2026
Since this post went up, Anthropic has added on to the CVP program, adding the higher tiered models such as Mythos 5.1, Opus 5.5, and Sonnet 5.5 to the list of models that can be tokenized for CVP related purposes. The add on structure is built around four named access levels (Defense Access, an individual variant of it, Red Team Access, and Specialized Access) and attaches a binding security requirements contract, including a December 15, 2026 deadline to move off static API keys and onto phishing resistant MFA. Anthropic’s own transition terms carry existing CVP members over automatically under their existing access, no reapplication needed. This also allows the existing CVP access to remain active, meaning that if you decided to now apply for the higher model tier access, you would still have access to the older models. The new structure is additional scaffolding around the same program, not a replacement for it. Full breakdown in the follow up: CVP, Revised: Tiers, Teeth, and a Hard Deadline. See the table and the figure below for how the new structure breaks down and maps onto what was already there.
| What | Still active, from the original program | Added by the Oct 2026 addon |
|---|---|---|
| Approval | Free, application based review; once approved, access holds | Existing approvals carry over automatically, no reapplication |
| What’s unlocked | Default blocks lifted on pentesting, red teaming, bug bounty, and the exploit analysis that comes with them | Same scope, now scoped by which tier you hold |
| What’s always blocked | Command and control infrastructure, mass data exfiltration, ransomware development | Unchanged |
| Models covered | Claude Opus, Claude Sonnet | + Claude Mythos 5.1, Opus 5.5, and Sonnet 5.5 |
| Program shape | One program, one approval | Four named access tiers layered on top: Defense Access, Defense Access for Individuals, Red Team Access, Specialized Access |
| Security obligations | Not published at the time I applied | A binding Security Requirements contract: named security contact, breach reporting windows, compliance evidence on request |
| Credentials & MFA | Not addressed | Static API keys banned and phishing resistant MFA required by Dec 15, 2026 |
Part I
The Case for CTFs
CTFs are where I started to actually excel in my theoretical coursework: concepts I had half forgotten had to be pulled back out of memory and applied live, under competition pressure, and that is what made them click. I consistently try to sell students on CTF competitions for exactly that reason, and one of the deeper projects I am working on traces back to them too. The competitions a lot of people are skeptical about are one of the most valuable training opportunities going, for humans and machines both. Why? CTFs are built to be progressively harder and grounded in real world situations, exposing the operator to new techniques as they go, and that same process can be repurposed as training data for the models being built for cybersecurity work. It’s pure data gold: the commands run, the logic behind each step, all of it logged and fed into the kind of retrieval corpus a model can actually draw on. That is wildly underestimated.
CTFs are wildly underrated by the wave of emerging cybersecurity specialists flooding the platforms; you can tell who’s actually battle tested by offering a simple challenge and watching the cert only résumés fall apart.
This is how I use CTFs, and how that foundation helped me secure a spot in Anthropic’s CVP program when it first launched. Since then, the program has changed: Anthropic shipped an updated CVP on October 6th, 2026.
The CTF work matters for a second reason, one that goes beyond any single application. Every solution we document is full methodology, not just the flag; it becomes structured data, a real problem worked from confusion to resolution, detailed enough that a model can learn from the reasoning, not just the answer. That’s the raw material small, locally run models need to get better at defensive reasoning without requiring access to production incident data most teams will never open source. From a research standpoint, the operators gathering this data are producing and logging new data in real time, every time they start a new challenge in a sanctioned CTF.
Contestants and researchers generate the data that trains the defensive models, and those models become the tooling built for the next contestants.
When students publish complete CTF methodology, we’re not just building a portfolio; we’re generating exactly the kind of training signal that makes local, defensive focused tooling viable for people who can’t afford enterprise scale compute. Contestants generate the data that trains tools built for other contestants; that loop is part of why this work feels worth doing beyond the résumé line. It was never really about the flags. The training data is the real flag.
Part II
The Trust Boundary
From the perspective of a student researcher and active CTF competitor, this is where the real tension shows up: vulnerability analysis, exploit development, and offensive tooling for CTFs fall squarely into what Anthropic classifies as high risk dual use, and the new CVP structure now breaks that down even further into tiers that are setting what may become an industry standard for this kind of regulation. At the level of a raw request, a defender studying an exploit and an attacker weaponizing it can look identical, so Claude’s Opus and Sonnet models, and now Mythos, block that category by default. It’s a necessary safeguard, but it’s also exactly the kind of friction legitimate practitioners run into constantly. Which is why the new structure breaks that risk down into tiers: Defense Access (with a dedicated track for individuals), Red Team Access, and Specialized Access, each one unlocking more permissions and higher tier models as the bar for who’s asking goes up. See the breakdown below.
And yet, building accessible security systems still requires the ability to analyze telemetry patterns, binaries, and behavioral traces through API driven workflows, the very processes that support the data collection pipelines these models rely on. That’s the contradiction we keep running into: the work that makes defensive tooling accessible is the same work safety systems are designed to resist. It’s become clear that Anthropic’s stance on high risk model access is a progressive, ongoing initiative, one that’s pushing the industry to adapt to real standards and regulation built for the LLM era.
Should every user get elevated permissions? Of course not. But refusing outright is the easy answer, not the right one: building a clear mapping and permissions system instead is what the industry, and especially the commercial public sector, needs as an ethical target for steering AI development somewhere good.
Anthropic’s application is free, and anyone can apply. The vetting process is built to filter the general public down to the practitioners who actually work with this tooling: the people defending systems and building the technology, not just asking about it.
What the approval does and does not cover matters; precision here isn’t optional. CVP lifts default blocks on dual use activities: basic pentesting, red teaming, bug bounty, and the exploit analysis work that naturally comes with them. It does not unlock prohibited use activity: command and control infrastructure, mass data exfiltration, ransomware development, and it never will. Those stay blocked regardless of status, by design.
A verified practitioner isn’t a practitioner with fewer rules; it’s one whose legitimate work has been documented clearly enough that the system can reliably tell the difference.
What I believe actually strengthened my application (based on going through it, not on any inside knowledge) is that a documented, consistent pattern of legitimate defensive work counts for more than any single credential. In my case, that meant our CTF archive with full methodology on every solve, our academic standing, and the fact that ECHOClub is a real, accountable organization with a public footprint rather than a one off account. The updated application may also ask for credentials like bug bounty platform verification, certificates with their ID numbers, published write ups and reports, and accredited documentation such as SOC 2 reports, depending on what you’re applying as. If your defensive intent is legible on paper before a human ever has to guess at it, that’s the strongest thing you can bring.
The approval also unlocks something subtle but incredibly important: the ability to process CTF data without constant safety interruptions, which means I can take full methodology write ups, packet captures, binaries, and forensic artifacts and convert them into machine readable defensive telemetry. That structured output becomes training material that small, locally run models can repurpose, improving defensive reasoning without needing access to enterprise grade incident data. In other words, CVP doesn’t just remove friction; it directly enables the creation of high quality defensive signals that benefit the entire local model ecosystem.
But that capability comes with responsibility. CVP access isn’t a badge; it’s a trust boundary. The data you process, the workflows you build, and the outputs you generate need to stay secured within your network and your research environment. Treat the privilege like you would any sensitive defensive infrastructure: controlled access, clear audit trails, and a culture of accountability. The program works because practitioners respect the line between defensive analysis and prohibited use, and because we protect the material we handle as if it were production grade. Along with the updated structure, this is starting to set a new standard for the digital security industry.
If you’re a security student, researcher, or practitioner who’s hit these blocks doing legitimate work, it’s worth applying. And if you’re building tooling meant to run on local models so that cost is never the barrier to entry, CVP is designed for exactly that kind of accessible, education first security work. It protects the people who are trying to make the field better, not harder to enter.
In the end, this is the kind of soul.md Anthropic aims to deliver with
programs like CVP, a philosophy of safety that doesn’t shut out legitimate
researchers, a commitment to accessibility that doesn’t compromise security, and a
belief that empowering the right people strengthens the entire ecosystem.
References
- Real time cyber safeguards on Claude Opus and Sonnet Anthropic · official support documentation support.claude.com/en/articles/14604842
- Cyber Verification Program: interest & application Anthropic · official form claude.com/form/platform-cvp-interest
- Cyber use case submission Anthropic · official form claude.com/form/cyber-use case
- False positive report & CVP rejection appeal Anthropic · official form claude.com/form/cyber-block-false-positive-report-cvp-rejection-appeal
Further reading
- Anthropic Fellows Program 2026 Anthropic Alignment alignment.anthropic.com/2025/anthropic-fellows-program-2026
- CVP: the Cyber Verification Program and defensive security Third party practitioner write up, not an official source bregg.com/blog/cvp-cyber-verification-program-defensive-security
Get in touch
Requests, collaborations, or concerns
If something here is wrong, or you want to work on it with us, say so. Corrections are welcome and get published.