Anthropic CVP tiers: AI agent controls for UAE businesses

Anthropic CVP for UAE businesses: what it changes

Anthropic has merged Project Glasswing and its Cyber Verification Program into one three-tier system. It gives qualifying security teams access to advanced Claude models with fewer cyber-related blocks, depending on the work they are authorised to perform. For most UAE businesses, this is not a reason to apply for access. It is a reason to test the AI agents already connected to business systems, keep permissions narrow and make sure someone can review what those agents do. (anthropic.com)

Anthropic announced the expanded programme on October 6, 2026. The company says the programme is available through the Claude Platform, Google Cloud’s Vertex AI and Microsoft Foundry. Access on Amazon Bedrock is limited to customers eligible for Anthropic’s Enterprise Frontier Safeguards. (anthropic.com)

The important business change is not the application form. It is the widening gap between what an AI agent can attempt and what an ordinary control process can see.

Anthropic CVP access tiers for cyber defence and red teams

Defense Access is aimed at defensive work. Anthropic lists security operations, incident response, malware reverse engineering, vulnerability analysis and validation. It says qualifying applicants may include company security teams, universities, government bodies, critical-infrastructure operators, smaller security firms, open-source maintainers and individual researchers with a record of reporting vulnerabilities. Anthropic expects to respond to applications within a few days. (anthropic.com)

Red Team Access adds authorised penetration testing and adversarial evaluation. It is intended for in-house red teams, government red teams and security testing firms. Anthropic says users still face blocks on actions that could cause physical harm or mass disruption, including ransomware deployment, damage to physical systems and testing of high-risk safety systems. Reviews are expected to take a few weeks, and applicants are placed in Defense Access while their red-team application is assessed. (anthropic.com)

Specialized Access has the fewest cyber restrictions. It is reserved for verified organisations testing systems that could affect lives or disrupt markets, such as flight systems, power grids, telecoms networks, interbank transfers and government administrative networks. Anthropic says these organisations are reviewed in depth with the US government. (anthropic.com)

CVP testing results: 34 of 50 Red Team tasks completed

Anthropic tested Claude Opus 5.5 against 10 CyScenarioBench challenges, with five attempts at each challenge. Without CVP access, every task was blocked at the first prompt. In Defense Access, 46 of 50 trials were blocked at some point and four succeeded. In Red Team Access, no blocks occurred and 34 of 50 tasks were completed. Anthropic says that matched the completion rate when safeguards were not applied. (anthropic.com)

Those figures do not mean a UAE business should remove safeguards. They show that safeguards can be adjusted to the job, and that the adjustment materially changes what a model can do. A sales agent, stock assistant or finance workflow should not receive the same permissions as an authorised security-testing environment.

Anthropic also says partners found at least 129,000 verified software vulnerabilities between April and July 2026. Its own open-source scanning found another 5,500 between April and October. More than 33,000 were rated critical or high severity, although Anthropic says the figures are based on partial data and are likely an undercount. (anthropic.com)

The Register reported a more uncomfortable part of the story: of 5,674 true-positive vulnerabilities cited in Anthropic’s figures, 3,014 were high severity and 1,522 were critical, while only 516 had been patched at the time of reporting. Finding problems faster does not fix them automatically. (theregister.com)

AI agent security controls for UAE businesses

The direct change is limited. CVP is for verified security work, not a general upgrade for every company using Claude. The wider lesson is more practical. As advanced models become better at finding weaknesses, businesses using agents should assume that testing, logging and remediation need to keep pace. This is an inference from Anthropic’s results and the gap between vulnerabilities found and vulnerabilities patched. (anthropic.com)

Consider a UAE retailer with an agent that reads orders, updates stock and prepares supplier messages. The sensible control is not to give the agent broad access because it is useful. Give it access to the order and inventory functions it needs. Require approval before supplier changes, refunds or bulk edits. Keep an audit trail. Test whether a hostile instruction hidden in a product description, email or uploaded document can make the agent ignore those limits.

If the workflow is being built or extended, ERP and automation services are the relevant place to discuss the system design. If an agent is being connected to a customer-facing site or app, website and mobile app development is the more direct route. The security work still needs clear ownership, written permissions and testing against the actual workflow.

UAE AI agent permissions, logging and patching checklist

Most small firms do not need Anthropic’s Specialized Access. They may not need CVP at all. They do need to know what their agents can change, how those changes are checked and how access is withdrawn when something goes wrong.

For a second view of agent permissions, see Safer Agent Access for UAE Apps With Vercel Connect. Anthropic’s expanded Cyber Verification Program announcement sets out the access tiers and testing results.

• —Map every AI agent to the data, tools and accounts it can reach
• —Separate reading, drafting and executing permissions
• —Test prompt injection through emails, documents, product records and support tickets
• —Log actions and review unusual changes, failed requests and repeated access attempts
• —Keep a patching owner and deadline for every confirmed vulnerability

Paknology support for AI agent workflows

Paknology has a commercial interest when this work involves ERP and automation, websites or mobile apps, or another service it provides. It does not replace a specialist security consultancy or a formal penetration test. If your business has no AI agent, no exposed automation and no system change planned, a simpler option is to document current access, turn on available logs and review permissions internally rather than buy new work.

If you are adding an agent to an existing business process, start by documenting its permissions and test cases, then use ERP and automation support if the workflow needs to be designed or rebuilt.