Oknek joins Anthropic's Cyber Verification Program.

Frontier models now refuse or interrupt a lot of legitimate offensive-technique work by default — that's the correct default for the public internet. The Cyber Verification Program is Anthropic's pathway for the teams whose day job legitimately looks like an attack: it's a free, application-based program where Anthropic reviews the organization, and approved defenders get access to Claude's dual-use cyber capabilities with adjusted safeguards, scoped to defensive work — exploitability analysis, adversarial simulation, threat modeling, detection testing, security-control validation. Categories with no defensive reading (mass-exfiltration tooling, ransomware development) stay blocked for everyone, verified or not.

The context that makes this matter: in November 2025 Anthropic disclosed the first largely AI-orchestrated cyber-espionage campaign — an agent executing 80–90% of operations at machine speed. Agents are now on both sides of the line. The CVP exists so the defensive side isn't studying that reality with one hand tied.

Every Oknek rule is a claim about attacker behavior: that a compromised agent will chain subcommands past the policy cap, rewrite its own permission file, read a credential it has no business touching, tunnel egress somewhere unlisted, or reach for the enforcer's own off-switch. Claims like that rot unless you attack them. Verified access lets us do that work properly, before rules ship:

• Exploitability analysis of disclosed agent CVEs — reconstructing attacks like the CC-643 subcommand-chain bypass or the MCP hijacks, and confirming the corresponding rule catches the reconstruction, not just the write-up.
• Adversarial simulation against the enforcement layer itself — R11's egress jail, R13's cross-process credential reads, R20's anti-unpin self-guard — played by an adversary that doesn't read our docs first.
• Detection testing for the audit trail: does every step of a realistic kill chain land in Okular as evidence a responder can actually use?

Findings feed the R-pack. When a simulation beats a rule, the rule changes. That loop is the whole point of asking for the access.

Three things this announcement does not license us to imply, written down so you can hold us to them:

• It is not a certification of Oknek. Anthropic vetted our organization for responsible dual-use research access. Nobody at Anthropic audited oknekd, our rules, or our claims.
• It is not a partnership or endorsement. We're one of a growing list of accepted security teams. Anthropic doesn't recommend Oknek, and we don't speak for Anthropic.
• It changes nothing about what Oknek requires. Enforcement is in-kernel and model-vendor-independent — Oknek guards agents whatever model they run on, and it worked the same way the day before we were accepted.

What it is: a signal that a serious model provider looked at who we are and what we do, and concluded we're the kind of team that should be studying agent compromise with real capability. We'll take that — accurately described — every time.