Click any tag below to further narrow down your results
Links
Anthropic is rolling out a three-tier access program that gives vetted cybersecurity professionals and organizations stronger versions of Claude with reduced safety guardrails for defensive and authorized offensive security work. The tiers range from basic defensive access to specialized testing of critical infrastructure like power grids and flight systems.
- Defense Access tier is open to security teams at companies, nonprofits, universities, and critical infrastructure operators doing defensive work; Red Team Access adds authorized penetration testing for vetted organizations; Specialized Access is limited to organizations testing safety-critical systems like power grids and telecom networks, reviewed with US government collaboration.
- In testing with CyScenarioBench, Claude Opus 5.5 blocked every task without CVP access, blocked 46 of 50 tasks in Defense tier, and succeeded on 34 of 50 tasks in Red Team tier—matching its performance without any safeguards.
- Project Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026 using Claude Mythos, with over 33,000 rated as critical or high-severity; partners reported the models accelerated their vulnerability discovery by months or years.
+ cyber verification program
+ claude
+ anthropic
+ cybersecurity
penetration testing
+ vulnerability discovery
+ security
A developer hired a penetration tester to attack his FastAPI staging environment and within 45 minutes the tester exploited leaked OpenAPI docs, an unprotected IDOR endpoint, a hard-coded JWT secret, a raw-SQL reporting endpoint, and lax webhook verification to gain full admin access and dump the database. The report lists critical flaws and warns of exposed production keys in staging.
- Auto-generated OpenAPI/Swagger docs left public let the tester map the entire schema and find a forgotten admin-role endpoint in just 8 minutes.
- An unprotected GET /users/{user_id} endpoint let him swap IDs to steal the admin's email, bcrypt hash, and API keys.
- A hardcoded JWT secret found via Google cache of a deleted GitHub issue let him forge tokens and impersonate admin.
- A raw f-string SQL "reports" endpoint was UNION-injectable, dumping every user's credentials and Stripe IDs, and he then hijacked the Stripe webhook to redirect payments—all in 45 minutes total.
NetExec is the unified, open source continuation of CrackMapExec, originally created in 2015 by byt3bl33d3r and maintained by mpgn_x64 until 2023. A group of core contributors merged private and public code bases, streamlined development, and now publish regular updates under the new NetExec name.
- NetExec is the direct successor to CrackMapExec, launched after original maintainer mpgn_x64 stepped down in September 2023.
- Development had been split across a private and public repo, causing a 6–8 month delay in community fixes landing publicly.
- Core contributors NeffIsBack, Marshall-Hallenbeck, and zblurx merged the codebases into one fully open public repository under the new name.
- The project now commits to regular releases and open contributions going forward.