Anthropic's Cyber Verification Program Expands: How AI Is Changing Vulnerability Scanning After 129,000 Flaws Were Identified
Partners in Project Glasswing verified at least 129,000 software vulnerabilities between April and July 2026, and more than 33,000 were rated critical or high severity.
Software is written faster than it can be checked. This is very familiar to security professionals, and it’s even more familiar to the hackers. The expansion by Anthropic of its Cyber Verification Program on October 6, 2026, has proven through its findings how AI can address this issue.
What Is Vulnerability Scanning and Why Does It Matter in Modern Cybersecurity?
A vulnerability scan is basically the periodic testing of software and systems for vulnerabilities. It is like an inspection process where each lock and window is tested for its security and a report is provided on areas that need attention before any intruder notices them.
A test of this sort is required by all companies that use software because just one weak point could create problems for their clients or even shut down the company. Traditional tools compare systems against lists of known problems. That works for familiar issues and poorly for new ones, which is why AI cybersecurity has become a board level topic and not only a specialist one.
Anthropic’s Cyber Verification Program: What the 129,000 Vulnerabilities Reveal
According to Anthropic’s October 6 announcement, partners in Project Glasswing verified at least 129,000 software vulnerabilities between April and July 2026. Anthropic’s own open source scanning added 5,500 more by October, and more than 33,000 were rated critical or high severity.
Anthropic calls these numbers a lower bound, since they come from only some partners, and expects the true impact to be at least five times higher. That is a strong case for AI in software testing and AI vulnerability detection at scale.
The Three Access Tiers
The program now has three levels, each covering Claude Opus 5.5, Sonnet 5.5 and Mythos 5.1. Defense Access suits security operations, incident response and malware analysis. Red Team Access adds authorized penetration testing. Specialized Access has the fewest blocks and is reserved for organizations testing systems such as power grids, with each one reviewed alongside the US government.
One caution comes from VulnCheck, which found that only 2 of 300 related vulnerabilities, about 0.67%, had been exploited in the wild, as The Hacker News reported. Finding flaws and stopping attacks are connected jobs, not the same job.
How AI Is Transforming Vulnerability Scanning and Software Security Testing
A traditional scanner matches patterns. An AI algorithm scans the code like a knowledgeable reviewer would do following data flow within the software and questioning where the data may be exploited. This is the basis of an AI based vulnerability detection: analyzing the intent of the code and finding its weak spots.
It is only one step of the overall transformation of AI in software testing people now utilize the AI based testing software for code analysis, writing test cases and spotting potential risks in code changes. When AI testing tools join automated software testing in a build pipeline, checks run on every update instead of once a quarter.
Anthropic’s own tests show why access is controlled. On the CyScenarioBench test, Claude Opus 5.5 was blocked on every task without program access. Red Team level was not restricted and performed 34 out of 50 missions. The attributes that may help the defenders to defend can help the attackers to attack as well; that is why verification is so important for AI cybersecurity systems.
Comparative Analysis: Traditional Scanning vs. AI Powered Vulnerability Detection
The table below compares traditional vulnerability scanning with AI vulnerability detection.
| Parameter | Traditional Vulnerability Scanning | AI Powered Vulnerability Detection |
|---|---|---|
| Detection Methodology & Scope | Matches systems against databases of known flaws. | Reads and reasons about code and configuration. Can surface unknown flaws across large codebases. |
| Speed & Analysis Depth | Quick scheduled sweeps, usually at the surface level. | Deeper review of each file, and it fits automated software testing pipelines. |
| Handling Complex Code Logic | Weak on business logic and flaws that take several steps to exploit. | Follows data across files and functions, so it can catch multi step problems. |
| False Positive Management | Often returns long lists that analysts sort by hand. | Can explain and help validate findings, though people make the final call. |
AI Powered Vulnerability Scanning vs Traditional Security Testing: Key Differences
Traditional security testing, such as manual code review and penetration tests, depends on scarce specialists. Three differences stand out.
Scope comes first. A conventional scan checks what is already known, while AI powered vulnerability scanning also looks for what nobody has noticed yet. People come second. Scanners hand analysts a list, but AI vulnerability detection can explain a finding, suggest a fix and test it. Control comes third. Stronger tools need stronger safeguards, so Anthropic requires data retention in the program to watch for misuse. AI in software testing follows the same rule: more power calls for more oversight.
The Benefits of AI Driven Vulnerability Scanning for Developers and Businesses
The first benefit is speed. If partners are finding flaws months or years sooner, as Anthropic reports, the window in which a weakness stays open gets much shorter.
The second is coverage. A small team can’t read millions of lines of code by hand, but AI driven vulnerability scanning lets it examine far more of its software. Automated software testing then checks each change as developers write it.
The third is focus. Developers spend less time on false alarms and more on fixes that matter. Defense Access is open to regional hospitals, municipal utilities and open source maintainers, so these AI cybersecurity gains are not limited to large companies. Good AI testing tools make that reach possible.
Challenges and Risks of Using AI to Detect Software Vulnerabilities
AI in software testing is not magic, and it brings risks. Findings from AI vulnerability detection still need human verification. Anthropic notes that fewer than half of partners reported patch numbers, often because fixes were still in progress. A found flaw is only half the work.
Dual use is the next concern. The same cyber security ability in AI that assists the defender will also assist the attacker; hence, it is because of this reason that there are access tiers. The other important aspect is privacy, especially in cases where one sends the proprietary code to the service. Finally, there is over trust. Even strong AI testing tools can miss flaws, and a clean report from automated software testing does not prove software is safe.
How Businesses Can Integrate AI Powered Vulnerability Scanning into Their Security Workflows
Adopting AI in software testing doesn’t require top tier access. Anthropic says its generally available models can already handle code review, patching known issues, vulnerability finding in owned source code and triage of security alerts. A practical path looks like this:
- Inventory what you run. List applications, repositories and cloud services.
- Start in the pipeline. Add automated software testing to every code change so problems surface early.
- Pair AI with people. Let AI testing tools draft findings and let a person approve them.
- Track fixes, not only findings. Measure how long each flaw stays open.
- Apply for verified access if you qualify. Anthropic aims to answer Defense Access applications within a few days.
Teams that want help can look at EL-ROI IT Solutions’ software testing services to build AI cybersecurity checks into delivery, and its maintenance and support plans to keep applications updated and monitored.
Frequently Asked Questions About Vulnerability Scanning
1. What is Vulnerability Scanning?
Vulnerability scanning refers to the automatic discovery of any security flaws in applications, networked systems, and devices. It results in an ordered set of items that need fixing.
2. What role does AI play in vulnerability detection?
The AI vulnerability scanner understands the code in its context, meaning it can trace the problem through several files, and explain why it’s a problem, thereby detecting issues not found by pattern matching techniques.
3. What is the difference between vulnerability scanning and penetration testing?
Vulnerability scanning is the process of discovering vulnerabilities and ranking them in terms of severity, while penetration testing takes this process a step further by taking advantage of the identified vulnerabilities.
4. Can AI powered vulnerability scanning replace manual security testing?
No. The implementation of AI in software testing offers more than what a security team can achieve, yet it will still be humans who decide on reality and what should be prioritized. View AI testing as a powerful tool rather than as a substitute.
5. How frequently should companies scan their software for weaknesses?
Perform scans after any major changes to the code and regularly (weekly/monthly for production systems), or for companies that perform automated software testing, after each release.
