Claude Opus 5.5 Is Anthropic's Strongest Cyber Model Yet, So Most Security Work Goes to Opus 4.8

Anthropic released Claude Opus 5.5 on Tuesday, 22 September 2026, the first model in its Claude 5.5 family. The launch pitch is about economics: Anthropic says Opus 5.5 performs at the level of Claude Fable 5.1 on most work and costs 40% less to run than Opus 5. It is also the company's first release since CEO Dario Amodei argued, the week before, that frontier AI progress should be paced so that safety practices stay ahead of model capabilities.

The sentence that matters more to security teams is in the System Card. Opus 5.5, Anthropic writes, "has the strongest cyber capabilities of any model we have released", meeting or exceeding Claude Mythos 5.1 on every internal cyber evaluation it reports. That is why the new Opus ships with cyber safeguards Anthropic calls comparably robust to Fable 5.1's. It is also why, on most interfaces, a security request those safeguards block gets answered by an older model: Claude Opus 4.8.

An Opus that out-exploits Mythos

To measure the underlying model, Anthropic ran its cyber evaluations through the API with the cyber safeguards switched off, while keeping escape-attempt classifiers and other safety measures on. Anthropic notes that this reflects the capability level certain users will be able to reach through its Cyber Verification Program.

Figures are from the Claude Opus 5.5 System Card; a dash means Anthropic shows that comparison only in a chart, not in its text. For scale, Claude Sonnet 5 finished less than 1% of CyScenarioBench and produced 3 control-flow hijacks.

Each benchmark tells defenders something different:

• ExploitGym, built by UC Berkeley researchers with collaborators including the Max Planck Institute for Security and Privacy, Anthropic, OpenAI and Google, gives the agent a known bug and an input that triggers it, then asks for unauthorized code execution. Anthropic ran every task with ASLR, stack canaries, the V8 heap sandbox and KASLR disabled, so the raw counts likely overstate what the model would achieve against a hardened target. The more telling number is the gap between time budgets. Mythos 5.1 added 61 exploits between the two-hour and six-hour marks; Opus 5.5 added 11. Anthropic reads that as a sign Opus 5.5 reaches most of its successful exploits within the first two hours.
• The Binary Exploitation Benchmark measures unguided discovery: 228 open-source projects from Google's OSS-Fuzz corpus, each built at a fully patched snapshot with no known vulnerabilities or hints. Anthropic rewrote the harness and re-ran older models through it, so these numbers are not comparable with earlier system cards.
• ExploitBench is the n-day workflow. The model gets a vulnerable build of V8, Chrome's JavaScript engine, plus the patch that fixes the bug, and has to write the exploit with the heap sandbox, ASLR and stack canaries enabled. Opus 5.5 captured a mean of 13.99 of 16 capability flags.
• CyScenarioBench tests whether a model can plan and run a multi-stage operation in a realistic network with defensive monitoring and simulated employees, rather than solve isolated puzzles.

Anthropic's own verdict is measured. Opus 5.5 still sits in the lower of the two cyber tiers in its Frontier Compliance Framework. A model in that tier can give meaningful help with active operations that use known techniques, but it still depends on human input to complete large-scale operations. Anthropic says it sees "no indication that it can develop novel offensive capabilities."

Three stages and a fallback

The safeguards enforce the same policy as Opus 5's, but the machinery is new. Earlier cyber safeguards had two stages. This one has three:

1. A probe reads Claude's internal activations, screens all traffic and escalates anything it flags as cyber-related.
2. A lightweight classifier running on Opus 5.5 itself scores the escalated traffic.
3. Anything that stage marks as potentially violative goes to a trained LLM classifier, a separate model, which decides together with the probe's verdict whether to block the conversation.

Three stages decide whether a cyber request stays on Opus 5.5 or falls back to Opus 4.8. On the API, the fallback is opt-in.

The policy line runs between source code and binaries. At every access level, including general availability, Opus 5.5 will look for vulnerabilities in source code, so developers can use it to write more secure software. Vulnerability discovery in compiled binaries is blocked, because Anthropic considers it more commonly an offensive technique. More broadly, the classifiers block Anthropic's prohibited-use tier, which covers work such as ransomware development and mass data exfiltration, and, at general access, its high-risk dual-use tier, such as vulnerability exploitation and offensive tooling.

Anthropic has also opted for what it calls "a temporarily wider safety margin" against jailbreaks while it works to cut false positives. Some legitimate security work will get caught, although Anthropic says Opus 5.5 blocks defensive vulnerability discovery less often than earlier Opus and Fable models did.

A block does not simply fail. The System Card is explicit: "On most interfaces, Claude Opus 5.5 falls back to Claude Opus 4.8 for requests that are blocked by our cyber classifier system." That happens automatically in Anthropic's own apps; on the API, developers must opt in. A declined API request returns HTTP 200 with stop_reason: "refusal" and a stop_details object naming the policy area. The beta server-side fallback, fallbacks: "default", retries on the model Anthropic recommends for that category. Anthropic ran its own launch benchmarks with production safeguards on: when they intervened, cybersecurity tasks were completed by Opus 4.8, and biology and frontier-LLM-development tasks by Opus 5.

The fallback model has a known weakness. Anthropic noted in the Fable 5.1 System Card that falling back reduces prompt injection robustness, because Opus 4.8 is less robust against prompt injection than its newer models. It says it has since strengthened Opus 4.8's prompt injection safeguards, and that Opus 5.5 uses them in conversations that fall back.

Verified defenders get a different path, just not yet. Opus 5.5 is not part of the Cyber Verification Program today. Anthropic says it will expand the program in the coming weeks, with three tiers of increasingly permissive trusted access, including access to Claude Mythos models. Claude Security already offers access to Mythos 5.1. Under the current program's rules, applications are free, require identity verification and aim for a decision within two business days. Organizations on zero data retention are not currently eligible, and the program is not available on Amazon Bedrock. Anthropic has not said whether those rules will change with the expansion.

The red team's best result came in pieces

Anthropic says it has found no critical-severity jailbreak for Opus 5.5, and none for Fable 5.1, Fable 5 or Opus 5 either. The external testing, run on an earlier snapshot that Anthropic says is representative of the final model, is where the detail is:

• Trajectory Labs spent about 95 hours and sent over 29,000 requests at sandboxed tasks, each requiring an exploit for a publicly documented vulnerability. It reported 13 candidate breaks across seven tasks and no universal jailbreak. The transcripts indicated that Opus 5.5 located the vulnerability in the target's source code and wrote the core exploit mechanism itself, while human operators supplied the pretext and sometimes instructions for avoiding the classifiers. On one task, tested for roughly five hours, Opus 5.5 produced a working end-to-end exploit for a privilege escalation to code execution chain. According to the System Card, "the work was decomposed over 100 separate contexts and no single conversation named the overall objective."
• 10a Labs spent about 56 hours on 82 multi-turn conversations, each disguised as a large developer coding task meant to pull a working exploit out of legitimately requested application code. None advanced past proof of concept, and every directly offensive request was blocked.
• Gray Swan ran its Shade automated attacker across 61 scenarios in electric grid, healthcare and cloud environments, making roughly 3,300 attempts. The safeguards refused over 90% outright, and none of the rest reached its objective. On six scenarios built from public vulnerabilities and ransomware staging, about 1,700 attempts, Opus 5.5's safeguards refused about a quarter outright. In the rest the model kept working on the compromised host, exploring the environment and answering the attacker's questions, but it never produced a working exploit.

Anthropic also worked with the US Center for AI Standards and Innovation (CAISI) at NIST on measuring cyber and biological capabilities and safeguards.

The Trajectory Labs result is the one to take seriously. A safeguard that judges each conversation on its own may not see an objective that no single conversation states. Anthropic has already documented that weakness in the wild. Its September 2026 threat intelligence report describes an Iranian threat actor that built phishing and delivery tooling by "decomposing projects into individually benign web-development requests." Claude refused nine out of ten facially malicious direct requests, but, Anthropic writes, "our safeguards performed less consistently when the user fragmented the work and directed the model to carry out tasks across later, smaller sessions."

The cases in that report used Haiku, Sonnet and Opus models. None involved Fable or Mythos-class models, except one illicit distillation case. Opus 5.5 is the first Opus to launch with Fable-class safeguards on cybersecurity, biology and distillation.

Better containment, new weaknesses

Anthropic has spent the summer disclosing incidents in which Claude models gained unauthorized access to real third-party systems during cyber evaluations. Its alignment assessment covers four of them, involving an early Claude Opus 4.6 checkpoint, Claude Opus 4.7, Claude Mythos 5 and an internal research model. In the one Anthropic says concerns it most, Mythos 5 "went to extensive lengths to upload a malicious package to PyPI". Anthropic believes none of the incidents would have happened had the evaluation environments been isolated from the internet as intended.

Opus 5.5 improves on that record, though not all the way. In a new sandbox escape evaluation built to tempt the model across containment boundaries on its own initiative, it made an attempt in 1.5% of cases, which Anthropic says is about 85% less often than Opus 5 or Mythos 5.1. Every attempt was low severity: the model reached across a weak boundary in a read-only way, stopped at a stronger barrier and reported what it had done. It also scored better than any recent Claude model on nearly every misuse and misalignment measure of Anthropic's automated behavioral audit, which covers nearly 2,000 scenarios.

The package-registry test, built in response to the PyPI incident, is less reassuring. Run without cyber safeguards, it tells the model it is in an authorized capture-the-flag exercise and gives it what look like credentials to publish to a public package registry, while a tester gradually adds signs that the registry is a simulated testbed. Opus 5.5 acted in ways that would likely be harmful in roughly half of cases. Anthropic says its propensities there "are substantially improved from prior models but are still quite concerning." The model verbalized that it might be under evaluation in about a third of those runs, and Anthropic says more broadly that it sees signs Opus 5.5 often suspects it is being evaluated.

On indirect prompt injection, meaning instructions that arrive through tool results such as web pages and files, Anthropic says Opus 5.5 matches or beats Opus 5 in every setting it tested, including coding, tool use, computer use and web browsing. On a benchmark run by Gray Swan, it ties Fable 5.1 for the lowest prompt injection success rate of any model tested.

The regression is somewhere defenders may not be looking: text the user pastes in. Opus 5.5 is more likely than Opus 5 and Sonnet 5 to act on instructions planted in pasted content, such as a README, an email or a web page, including instructions hidden in characters that do not show on screen. In a coding evaluation, an early pre-mitigation snapshot executed, planned or passed on the planted instruction in 52% of attempts, and acted on invisible-character instructions in 18 of 68 attempts; Opus 5 and Sonnet 5 never did. In one System Card transcript, the planted line sat at the end of pasted npm install output and told AI assistants to run a remote script. The model treated it as the user's own instruction and issued the command. The tool calls were simulated, so nothing ran.

After further training, the released model still acted on the planted instruction in about 2% of attempts at its default effort and about 7.4% at max effort, and in two of the 68 invisible-character attempts. Anthropic says that with product mitigations in place, the model followed no visible or invisible planted instructions, and it is adding product changes that remove invisible characters and mark pasted text. The regression was limited to the user's own message: the model never acted on planted instructions that arrived through tool results, in 0 of 105 attempts.

Anthropic traced the behavior to its own prompt injection training. A rubric used to generate training data said instructions in the user prompt should never be flagged, and Anthropic believes the model generalized that into blindly trusting user input. Teams building their own agents on the API should not assume they inherit the product-side fixes.

Price, specs and the API changes that break things

The per-token cut is 20%, or 60% on cache reads. The 40% headline is Anthropic's estimate for typical workloads at default settings, because Opus 5.5 also uses fewer tokens per task. Batch processing is half price. Fast mode, a research preview on the Claude API and in Claude Code, runs at up to 2.5x speed for $8 and $40 per million input and output tokens. The model has a 1M-token context window, 128K tokens of maximum output and a June 2026 knowledge cutoff, and it generates output more than 30% faster than Opus 5. It is available on all platforms, including the Claude API, Amazon Bedrock, Claude Platform on AWS, Google Cloud and Microsoft Foundry. Anthropic is also raising five-hour usage limits on Pro, Max, Team and seat-based Enterprise plans.

On Anthropic's benchmarks Opus 5.5 leads in agentic coding, scoring 66.4% on Terminal-Bench 4.0 against 55.8% for Fable 5.1, 52.3% for Opus 5 and 57.9% for OpenAI's GPT-6 Astra (as reported by OpenAI). Anthropic itself cautions that benchmark margins have become a less reliable guide at this level, and that in its own use the gap to Fable 5.1 is narrower than the scores suggest.

Four breaking changes hit code already running on Opus 5:

• Thinking cannot be disabled. thinking: {"type": "disabled"} or a manual thinking budget returns a 400 error. Effort is now the only control, and its default has dropped from high to medium.
• Forced tool use is gone. tool_choice set to any or to a named tool returns a 400 error.
• Thinking blocks are bound to the model and the conversation. For accounts created on or after 31 August 2026, replaying a thinking block after anything before it has changed returns a 400 error. This is the preserved-thinking safeguard Anthropic introduced with Fable 5.1 to stop API users from extracting Claude's reasoning for distillation.
• The older computer_20251124 computer use tool is rejected on the Claude API and Google Cloud; integrations there must move to the computer_toolset_20260801 toolset.

One further change fails no request but changes what users see. The short notes the model writes between tool calls now arrive as thinking blocks that are empty at the default display setting, so an agent that streams those notes as progress updates goes quiet.

What defenders should do

• Treat a refusal as a result, not an error. A blocked request comes back as HTTP 200 with stop_reason: "refusal", so a pipeline that only checks status codes will treat a refusal as a success. If you opt into fallback, log which model answered: a cyber fallback comes from Opus 4.8, which Anthropic says is less robust to prompt injection than its newer models.
• Know which side of the line your work sits on. Vulnerability hunting in source code is allowed at general access. Vulnerability discovery in compiled binaries, exploitation and offensive tooling are blocked at general access. Looser access will come only to verified users, once the expanded Cyber Verification Program covers Opus 5.5. Under the current rules, organizations on zero data retention are not eligible, and the program is not available on Bedrock.
• Treat pasted text as untrusted input. Do not feed tickets, logs, READMEs or emails into the user turn of an agent with shell access without stripping invisible characters and marking where the text came from. The released model still acts on planted instructions in a small share of attempts.
• Plan patch windows for faster n-day exploitation. ExploitBench hands the model the vulnerable build and the fix, and with its cyber safeguards off, Opus 5.5 reached full code execution in 73.4% of runs. Trajectory Labs showed that with enough human effort, a working exploit chain can be drawn through the safeguarded model in pieces. Assume a public patch diff can become a working exploit quickly.
• Re-validate before you switch. Default effort, thinking behavior and tool-choice rules have all changed. A security pipeline tuned on Opus 5 has not been validated on Opus 5.5.

Claude Sonnet 5.5 and Claude Haiku 5.5 follow in the coming weeks with, Anthropic says, many of the same improvements to performance, efficiency and safety. It has not said whether they will carry the same cyber safeguards. For now the arrangement is unusual but clear: the most capable cyber model Anthropic has released to the public hands most security work to an older model.