2 links tagged with all of: penetration testing + security
Click any tag below to further narrow down your results
Links
Anthropic is rolling out a three-tier access program that gives vetted cybersecurity professionals and organizations stronger versions of Claude with reduced safety guardrails for defensive and authorized offensive security work. The tiers range from basic defensive access to specialized testing of critical infrastructure like power grids and flight systems.
- Defense Access tier is open to security teams at companies, nonprofits, universities, and critical infrastructure operators doing defensive work; Red Team Access adds authorized penetration testing for vetted organizations; Specialized Access is limited to organizations testing safety-critical systems like power grids and telecom networks, reviewed with US government collaboration.
- In testing with CyScenarioBench, Claude Opus 5.5 blocked every task without CVP access, blocked 46 of 50 tasks in Defense tier, and succeeded on 34 of 50 tasks in Red Team tier—matching its performance without any safeguards.
- Project Glasswing partners found at least 129,000 verified software vulnerabilities between April and July 2026 using Claude Mythos, with over 33,000 rated as critical or high-severity; partners reported the models accelerated their vulnerability discovery by months or years.
+ cyber verification program
+ claude
+ anthropic
+ cybersecurity
penetration testing
+ vulnerability discovery
security
A developer hired a penetration tester to attack his FastAPI staging environment and within 45 minutes the tester exploited leaked OpenAPI docs, an unprotected IDOR endpoint, a hard-coded JWT secret, a raw-SQL reporting endpoint, and lax webhook verification to gain full admin access and dump the database. The report lists critical flaws and warns of exposed production keys in staging.
- Auto-generated OpenAPI/Swagger docs left public let the tester map the entire schema and find a forgotten admin-role endpoint in just 8 minutes.
- An unprotected GET /users/{user_id} endpoint let him swap IDs to steal the admin's email, bcrypt hash, and API keys.
- A hardcoded JWT secret found via Google cache of a deleted GitHub issue let him forge tokens and impersonate admin.
- A raw f-string SQL "reports" endpoint was UNION-injectable, dumping every user's credentials and Stripe IDs, and he then hijacked the Stripe webhook to redirect payments—all in 45 minutes total.