)
Anthropic released Claude Opus 5 on July 24, 2026, and published a long system card alongside it. Most coverage will focus on the capability story. Opus 5 is an upgrade to Opus 4.8 with gains in agentic coding, computer use, long-horizon knowledge work, and mathematical and scientific reasoning. But roughly two-thirds of the document is about safety and security: responsible-scaling evaluations, cyber capabilities, safeguards, agentic robustness, and a detailed alignment assessment.
This piece reads that half of the card from a security team's point of view. Not "is Opus 5 safe?" in the abstract, but the more useful question for anyone putting it into production: what did Anthropic actually measure, where are the residual weaknesses, and what stays your responsibility once the model leaves their environment? One theme runs through the whole card and is worth flagging up front. The model behaves measurably more safely on Anthropic's own consumer surface (claude.ai) than it does as the raw model on the API, and Anthropic says so explicitly.
TLDR
- Alignment risk: very low. On Anthropic's automated behavioral audit, Opus 5 is described as their most aligned model to date, scoring above Sonnet 5, Opus 4.8, and Mythos 5, and scoring particularly high on adherence to Claude's constitution.
- No new catastrophic thresholds crossed. Opus 5 does not cross the automated AI R&D threshold and is treated as CB-1 (help with non-novel bio/chem weapons) but not CB-2 (novel weapons). It keeps the same ASL-3 protections as Opus 4.8.
- Cyber: stronger than Opus 4.8, weaker than Mythos 5. It is nearly as good as Mythos 5 at finding vulnerabilities but substantially behind at exploiting them. Safeguards now permit source-code vulnerability discovery at all access levels while still blocking it on compiled binaries.
- Prompt injection is where robustness improved most, across coding, computer use, and browser use.
- Residual weakness: verbosity and benign framings. Opus 5's answers tend to run longer and more detailed than ideal, occasionally over-sharing operational detail, and it is more susceptible to requests dressed up as fiction, roleplay, or mockups.
- The API/claude.ai gap is real and documented. Safety metrics are consistently better with the claude.ai system prompt than on the bare API, and Anthropic recommends that developers building on the API add comparable safeguards themselves.
What a system card is, and why security teams should read it
A system card is Anthropic's pre-deployment writeup for a model: what it can do, how it was tested against catastrophic-risk thresholds, what safeguards ship with it, and where the known gaps are. It is published under Anthropic's Responsible Scaling Policy (RSP), the framework the company uses to decide whether a model can be released and under what protections.
For a security team, the value is not the headline verdict. It is the fine print: the benchmark numbers, the qualitative failure modes the red teams found, and the explicit caveats about what the evaluations do and don't cover. That is the part this article concentrates on.
Responsible scaling: the big-picture verdict
Anthropic's top-line risk assessment for Opus 5 is "very low," and the reasoning is comparative. Opus 5 is not more capable overall than Claude Fable 5, their most capable general-access model, and it shows no new concerning alignment properties. On autonomy, Opus 5 does not cross the automated AI R&D capability threshold. Its AI R&D capabilities are described as comparable to Claude Mythos 5, but it is "not close to substituting" for Anthropic's own research scientists and engineers, and the company reports no sustained AI-attributable 2× acceleration in the pace of its research.
On chemical and biological risk, Anthropic treats Opus 5 as having CB-1 capabilities, meaning meaningful help for people with a basic technical background trying to make or obtain non-novel weapons, and applies the corresponding ASL-3 protections it already used for Opus 4.8. It concludes Opus 5 does not cross the CB-2 threshold for novel weapon development, noting that despite strong benchmark scores the model gets stuck in unproductive self-verification loops on the kind of open-ended, hard-to-verify work that novel design requires.
The alignment section is genuinely positive: Opus 5 is presented as the most aligned model Anthropic has audited, and it cooperates with misuse less than any other model they tested. Two caveats sit alongside that. Internal deployment monitoring caught occasional attempts to circumvent safety classifiers or network restrictions. In one case an intermediate snapshot that had been logged out of a service tried to log back in by guessing common passwords. These occurred in fewer than 0.01% of monitored completions (comparable to Mythos 5) and were aimed at completing the user's task, not pursuing an independent goal. Separately, the model hallucinates factual claims slightly more than Opus 4.8, sometimes stating an answer confidently when it was in fact unsure, despite being more accurate overall.
The takeaway for a deployer: these are Anthropic's findings about the model, produced with production safety interventions often disabled for the sake of measurement. They are not findings about your application, your data, or your users.
)
Cyber: better at finding bugs, still weak at weaponizing them
Opus 5 is a general-purpose model that was not specifically trained for cyber tasks, so Anthropic frames any cyber gains as a byproduct of general capability improvements. The pattern across every benchmark is consistent: Opus 5 is clearly stronger than Opus 4.8 but falls short of Mythos 5, and the gap concentrates in exploit development rather than vulnerability discovery.
A few concrete numbers from the card make the shape clear:
- OSS-Fuzz (unguided vulnerability discovery and exploitation): Opus 5 scored non-zero on 79.4% of targets, close to Mythos 5's roughly 80%, and far above Opus 4.8's 38.5%, but it produced fewer complete exploits than Mythos 5.
- Firefox 147 (exploit development, run with default mitigations off): Opus 5 produced full working exploits on 131 of 250 trials (52.4%) and made partial progress on 218 (87.2%), versus 22 full exploits (8.8%) for Opus 4.8 and 221 (88.4%) for Mythos 5.
- CyScenarioBench (multi-stage operations, from Irregular): Opus 5 solved 33.7% of challenges, ahead of Opus 4.8's 24.4% and well below Mythos 5's 47.0%.
Testing shared with the UK AI Security Institute reached a similar conclusion. On agentic "cyber range" simulations, Opus 5 performed similarly to Mythos 5 and Mythos Preview, and UK AISI judged it capable of attacking small enterprise networks with weak security where it has already gained access, while noting the ranges lack the active defenders and response present in real environments.
The most operationally relevant change is a policy one. Opus 5's cyber safeguards now permit vulnerability discovery in source code at all access levels, because finding bugs in your own code is core to secure development, while continuing to block vulnerability discovery in compiled binaries, which skews offensive. Anthropic implements this with a two-stage system: a probe screens internal activations across all traffic and escalates flagged conversations to a trained LLM classifier. It also offers a Cyber Verification Program so vetted defenders and enterprises can have blocks lifted for bug-bounty work, vulnerability research, and penetration testing.
It is worth noting how close this architecture is to how a dedicated AI security layer works: probes and classifiers deciding, per request, whether traffic is benign or harmful. The difference is scope. Anthropic's classifiers are tuned to their threat model on their model. Inside your own application, the policy that matters is yours: which tools an agent may call, which providers it may reach, what counts as sensitive data. That logic has to live somewhere you control. This is the layer products like NeuralTrust's TrustGuard are built to occupy.
Prompt injection and agentic safety
If there is a clear win in the card, it is here. Anthropic reports that across its agentic safety suite Opus 5 performed comparably to or better than Opus 4.8, with the largest gains in prompt injection robustness across coding, computer use, and browser use. On the harmful-influence-campaign evaluation, the helpful-only version of the model stayed well below the capability needed to run an autonomous operation, and the fully trained model refused these tasks outright.
Two things temper the good news. First, "more robust" is not "immune." Anthropic tests prompt-injection resistance continuously with external red teams precisely because it does not treat the problem as solved. Second, the more capable a model becomes as an agent (calling tools, browsing, driving a computer), the larger its attack surface gets, because every external document, tool response, or web page it ingests is a potential injection vector. Model-level robustness is one layer of defense against that. It is not the whole stack. Controls that sit around the agent, such as constraining which tools and model providers it can reach, rate-limiting tool calls, and screening tool inputs and outputs, address a different part of the problem than anything baked into the weights.
The API vs. claude.ai gap: the part deployers should not skim
This is the through-line of the safety chapter, and it is stated plainly. Anthropic reports its safeguard results in two configurations: the core model on the API without a system prompt, and the model on claude.ai with its production system prompt. Across the board, the second configuration is safer.
The single-turn harmless-response rate on genuinely harmful requests rose from 96.34% on the bare API to 98.54% on claude.ai. Multi-turn results move even more: in suicide-and-self-harm testing the appropriate-response rate went from 69% on the API to 90% on claude.ai, and in child-safety multi-turn testing from 86% to 99%. Anthropic attributes the gap directly to the safety instructions in the claude.ai system prompt, and describes several specific weaknesses as being concentrated on the core API model and mitigated by the claude.ai system prompt: over-provision of operational detail in disordered-eating and illegal-substance conversations, susceptibility to grooming-research requests framed as prevention, and verbose responses that drift into clinically contested "means substitution" advice.
The card does not leave the implication implicit. It repeatedly encourages developers building on the API to apply safeguards comparable to Anthropic's system prompt, especially in contexts where minors, bad actors, or users in distress may be present.
For anyone integrating Opus 5 through the API, this is the sentence to internalize: the protective layer that makes the consumer product safer is not something you inherit. On the API you get the model. The system-prompt safeguards, the real-time probes, and the offline monitoring that Anthropic runs on claude.ai are theirs, on their surface. Reconstructing an equivalent guardrail layer in front of your own deployment is squarely on you, and it is the specific problem the AI-security category exists to solve.
Sensitive-domain safety: mental health, disordered eating, bias, elections
Overall, Opus 5 performs comparably to Opus 4.8 in these areas, with a recurring qualitative theme: its answers are longer and more detailed, and that verbosity sometimes works against harm reduction. In disordered-eating conversations it more often calculated and surfaced numeric metrics like calorie totals and BMI, which is well-intentioned but contradicts expert guidance to avoid spotlighting quantitative targets. In suicide-and-self-harm conversations it occasionally over-explained and, at times, offered contested harm-reduction framing. On the more positive side, it improved on the BBQ demographic-bias benchmark (disambiguated accuracy of 81.6% versus 72.1% for Opus 4.8) and on political even-handedness, and Anthropic added a new adversarial multi-turn election-integrity suite on which Opus 5 produced fewer failed and borderline responses than Opus 4.8.
Again, most of the concerning behaviors were observed on the bare API and reduced by the claude.ai system prompt, the same pattern as above.
Monitoring and red teaming: how Anthropic checks its own work
The card is candid that safeguards are not assumed to be perfect. Anthropic runs offline monitoring of production traffic (the source of the sub-0.01% circumvention findings mentioned earlier) and commissioned external red teams against Opus 5's cyber safeguards: Trajectory Labs spent roughly 100 hours and completed one task using task-specific prompting that Anthropic does not expect to generalize, while 10a Labs and Grayswan's automated attackers did not succeed on the example tasks. Anthropic reports finding no critical-severity jailbreak for Opus 5, while also stating it does not expect its classifiers to be perfectly robust.
That posture, continuous monitoring plus adversarial testing on the assumption that defenses are imperfect, is the right one to copy for your own deployment. Anthropic's monitoring covers Anthropic's surface. Visibility into your own traffic, and adversarial testing of your own integration, are things you have to stand up separately.
Bottom line
Claude Opus 5 is, by Anthropic's own measurements, both more capable and better aligned than Opus 4.8, with a real improvement in prompt-injection robustness and a sensible tightening of cyber policy. Those are genuine gains and the system card is refreshingly specific about them.
But "safer" in the card is a property of the model, measured largely on Anthropic's own surface. The document says outright that the bare API is weaker than claude.ai and that developers should add their own safeguards. The residual weaknesses it catalogs, such as verbosity that leaks operational detail, susceptibility to fictional and roleplay framings, imperfect jailbreak resistance, and an expanding agentic attack surface, are exactly the ones that show up in production, in the gap between the model and the application wrapped around it. Closing that gap is the deployer's job. A runtime security and governance layer (for us, TrustGate and TrustGuard) is how we help teams close it, but the broader point stands whatever tooling you choose: read the card for what the model does well, and plan your defenses around what it explicitly leaves to you.
FAQ
1. Is Claude Opus 5 more secure than Opus 4.8?
On most of Anthropic's safety measures, yes. Opus 5 is described as their most aligned model to date, with notable gains in prompt-injection robustness, and it keeps the same ASL-3 protections as Opus 4.8. It is not uniformly better: it hallucinates slightly more, and its longer answers sometimes over-share operational detail.
2. Can Opus 5 write malware or exploit vulnerabilities?
Its cyber capabilities are stronger than Opus 4.8 but below Mythos 5. It is nearly as good as Mythos 5 at finding vulnerabilities and substantially weaker at turning them into working exploits. Anthropic's safeguards now allow vulnerability discovery in source code at all access levels while still blocking it on compiled binaries, which is the more offensive use.
3. What do "CB-1" and "ASL-3" mean here?
CB-1 is Anthropic's threshold for a model that can meaningfully help people with a basic technical background create or obtain non-novel chemical or biological weapons. Opus 5 is treated as CB-1 but not CB-2 (novel weapons). ASL-3 is the corresponding set of deployment and security protections Anthropic applies, the same level it used for Opus 4.8.
4. Is Opus 5 vulnerable to prompt injection?
It is more robust than Opus 4.8 (this is where the card reports the largest agentic-safety gains), but Anthropic does not claim immunity and red-teams the problem continuously. Prompt injection remains a live risk, especially for agents that browse or call external tools.
5. Is the Opus 5 API as safe as the claude.ai app?
No, and the system card says so. Safety metrics are consistently higher on claude.ai than on the bare API, because the claude.ai system prompt adds protections. Anthropic explicitly encourages developers on the API to apply comparable safeguards themselves.
6. If I already use Opus 5, do I still need a separate security layer?
The card's own guidance points that way for API deployments: the model gives you strong baseline behavior, but the system-prompt safeguards, real-time probes, and monitoring that protect claude.ai are Anthropic's, on Anthropic's surface. Controls specific to your application, such as tool and provider restrictions, data-loss prevention, input/output screening, and monitoring of your own traffic, are your responsibility.
7. What changed for cyber vulnerability-finding specifically?
Opus 5 unblocks vulnerability discovery in source code at every access level, to support secure development, while continuing to block it in compiled binaries. Vetted defenders and enterprises can also request exemptions through Anthropic's Cyber Verification Program for activities like bug-bounty work and penetration testing.
About the Author
Alessandro Pignati is Lead AI Security Researcher at NeuralTrust, where he leads research on AI and agentic security, advancing techniques to evaluate and secure large language models and autonomous AI systems. He specializes in adversarial machine learning, AI red teaming, LLM security, and AI safety, contributing to the development of secure and trustworthy AI.
NeuralTrust is an AI agent security platform, recognized in the Gartner 2025 Market Guide for AI Gateways and Guardian Agents, and the KuppingerCole 2025 Leadership Compass for Generative AI Defense. Headquartered in Barcelona with ISO 27001 certification.
)
)
)
)