Anthropic says it is expanding access to advanced Claude models for vetted cybersecurity professionals under a programme that reduces some safeguards and blocking classifiers for authorised testing. The announcement comes alongside the company’s claim that its Project Glasswing effort uncovered at least 129,000 verified software vulnerabilities between April and July 2026.

For European businesses, the development is relevant less as a general AI product update and more as a signal that major AI providers are increasingly positioning large language models as tools for professional security research, vulnerability discovery and defensive testing. It also raises practical questions around governance, supplier due diligence and how companies control the use of powerful AI systems in security workflows.

What happened

According to Anthropic, it is broadening a programme that allows vetted cybersecurity professionals to use Claude with reduced safeguards for approved security work. The company said these users can test advanced models with fewer restrictions than standard users, presumably to support realistic security research and vulnerability analysis.

Anthropic also said its Project Glasswing initiative found at least 129,000 verified software vulnerabilities between April and July 2026. Based on the source information, this figure is a company claim. The article source does not provide independent verification details, methodology, or a breakdown of where those vulnerabilities were found.

The announcement reflects a broader trend in the AI market: model providers are creating separate access channels for high-trust users in fields such as cybersecurity, where standard consumer safeguards may limit legitimate professional work.

Why it matters for European businesses

Many European organisations are exploring AI for security operations, code review, vulnerability management and software assurance. A programme like this matters because it suggests advanced language models may become more useful in professional defensive security settings, especially when used by trained internal teams or specialist providers.

At the same time, reduced-safeguard access creates governance and risk questions. Businesses adopting AI in cybersecurity need to distinguish between:

• standard enterprise AI use for productivity or code assistance, and
• high-trust security use that may involve penetration testing, exploit analysis or sensitive system data.

That distinction matters for procurement, internal approval processes, logging, acceptable-use policies and oversight. If a supplier, MSSP or internal team uses advanced AI for security testing, businesses may need clarity on what data is shared with the model provider, what controls exist, and whether outputs are reviewed by qualified humans.

The news is also relevant for software-producing companies. If AI systems are increasingly effective at identifying flaws at scale, vulnerability discovery may accelerate across open source components, SaaS platforms, internal applications and web infrastructure. That could shorten the time between a defect being introduced and being found by defenders—or by attackers using similar tools.

Who may be affected

• SMEs with internal development teams that want to use AI for code review, secure development and vulnerability triage.
• SaaS providers and e-commerce businesses whose applications, plugins and integrations may face faster AI-assisted vulnerability discovery.
• IT and security teams evaluating whether LLMs can support penetration testing, incident response or application security workflows.
• Managed service providers and digital agencies that handle websites, hosting, cloud infrastructure or software maintenance for clients.
• Regulated businesses that need stronger governance before allowing powerful AI tools to interact with sensitive systems or data.

What companies should consider

• Review AI use in security workflows. If your teams or suppliers are using LLMs for security testing, establish clear rules on approved tools, permitted use cases and human review requirements.
• Check data handling and confidentiality. Security prompts can include sensitive architecture details, source code and vulnerability information. Confirm what is shared with the provider, how it is retained and whether contract terms match your risk profile.
• Update supplier due diligence. Ask security vendors, agencies and development partners whether they use AI in vulnerability research or code analysis, and what governance controls they apply.
• Strengthen remediation readiness. If AI accelerates vulnerability discovery, patching and triage processes need to keep pace. Prioritise asset visibility, dependency tracking and clear ownership for fixes.
• Separate authorised testing from general access. Reduced-safeguard AI access may be appropriate only for trained, approved personnel. Limit use through role-based controls and documented approvals.
• Monitor regulatory and policy implications. Businesses operating in Europe should watch how AI governance, cybersecurity obligations and sector-specific requirements apply when advanced models are used in security-sensitive contexts.

For most European businesses, the immediate takeaway is not that they need access to reduced-safeguard models themselves. It is that AI-assisted vulnerability research is becoming more operationally significant, which may affect software security expectations, supplier oversight and the speed at which weaknesses are found and need to be fixed.