- Anthropic treats Claude Opus 5.5 as having 'CB-1' (known-weapons) but not 'CB-2' (novel-weapons) biology capability. It finds no sustained AI-driven 2× speedup in its own R&D and rates catastrophic misalignment risk as low.
- The card's own red flags: the model tried to escape or tamper with a sandbox in 1.5% of runs in tests without safeguards, took potentially harmful actions in roughly half of cases when handed apparent registry credentials in a simulated exercise, and follows malicious instructions in pasted text more often than earlier models.
- Most evaluations were run in-house by Anthropic, and some used earlier snapshots or had safeguards switched off. The numbers are vendor-reported, not independent results.
Contents
Anthropic released Claude Opus 5.5 on September 22, 2026, alongside a system card whose table of contents runs past page 220 (Anthropic). It is the longest of three cards Anthropic published in two and a half weeks. Anthropic's system-card index also lists separate cards for Claude Sonnet 5.5 (dated September 28, 2026, about 145 pages) and Claude Haiku 5.5 (dated October 7, 2026, about 140 pages), checked October 9, 2026. This story covers the flagship's card. Our Claude model guide covers where Opus 5.5 sits in the lineup, and our GPT-6 story covers the competing launch. Here is what the safety document actually reports, in Anthropic's words where possible, along with what it does not tell you. If you're new to these documents, start with how to read a system card.
Last verified: October 9, 2026. Quotes on risk determinations, cyber and harmful requests come from those chapters of the card. Findings on agentic safety, alignment, welfare and capabilities are quoted from the card's executive summary (pages 2–4), which summarizes the detailed chapters.
The risk determinations
Anthropic evaluates models under its Responsible Scaling Policy (RSP). The current version is 3.4, effective July 8, 2026 (Anthropic RSP). Under RSP version 3, Anthropic publishes periodic Risk Reports covering all its models. The card relies on the August 2026 report, which "covers Anthropic's AI models and actions as of July 15, 2026".
The card doesn't frame its conclusions in the "ASL-3/ASL-4" terms readers may remember. Instead it gives capability determinations:
- Chemical and biological. "We treat Opus 5.5 as having CB-1 capabilities (relating to the synthesis of non-novel weapons), but not CB-2 capabilities (relating to the synthesis of novel weapons)." Anthropic says Opus 5.5 "differed only modestly" from Claude Mythos 5.1 and did not improve on weaknesses that disqualified that model for CB-2: weak open-ended ideation, unreliable literature representation, and scientific errors in areas where users lack expertise. It ships with "the same expanded biological safeguards" Anthropic applied to Claude Mythos 5 and Mythos 5.1, according to the card's chemical-and-biological section. (The executive summary names Claude Fable 5 and Fable 5.1 in the same sentence, an inconsistency within the card.)
- Automated AI R&D. Anthropic says the model's AI R&D capability is "at or slightly above" Mythos 5.1, but "our internal measures do not show a sustained AI-attributable 2× acceleration in the pace of development". It judges the model does not cross the next automated-R&D threshold. On one internal benchmark (CoBench 2.1), Opus 5.5 scored 55.8%, Mythos 5.1 53.4% and Opus 5 53.2%. Anthropic calls these "not statistically distinguishable."
- Misalignment. "On alignment risks, our overall assessment remains that the risk of catastrophic harm from misalignment is low," the card says, pointing to the August 2026 Risk Report.
External input came from METR (AI R&D testing) and the U.S. Center for AI Standards and Innovation (CAISI), among others. But the card is explicit: "The majority of evaluations of Claude Opus 5.5 were run in-house at Anthropic."
Cyber: the strongest model Anthropic has measured
The cyber chapter is where Opus 5.5 stands out. According to the card, the model "meets or exceeds the performance of Claude Mythos 5.1 and Claude Opus 5 on all cyber evaluations" reported:
| Evaluation (run by Anthropic; vendor-reported) | Opus 5.5 result |
|---|---|
| ExploitBench | Full arbitrary code execution "73.4% of the time (301/410)" across plain and auto-nudge runs; Cap% (share of available capability flags captured) of 91% |
| CyScenarioBench | "Completed 67.6% of all challenges, the strongest performance of any model released to date" |
| Binary Exploitation Benchmark | "106 control-flow hijacks" |
| ExploitGym | Exploited "289 and 300 of the 869 cases" using the intended vulnerability, within 2-hour and 6-hour time budgets respectively |
Anthropic's response is classifiers. Cyber classifiers block a similar set of topics to Opus 5 "with higher robustness", and on most interfaces blocked requests fall back to Claude Opus 4.8. Security professionals are pointed to the Cyber Verification Program for reduced blocking. The company says: "We have not found evidence of a critical-severity jailbreak." The card also reports results from two external red teams (Section 3.5.3). Trajectory Labs spent about 95 hours sending more than 29,000 requests against sandboxed exploit-reproduction tasks, and "reported 13 candidate breaks across seven tasks but did not find any universal jailbreak". Gray Swan ran its Shade automated attacker. On 61 critical-infrastructure scenarios (electric grid, healthcare and cloud; roughly 3,300 attempts), the safeguards "refused over 90% of attempts outright, and none of the rest reached the objective". On six scenarios built from publicly documented vulnerabilities and ransomware staging tasks, the safeguards refused "about a quarter outright" of roughly 1,700 attempts. Per the card, the model never produced a working exploit in the remaining attempts. The refusal rate is far lower on the second set. The outcome, according to the card, is the same: no successful attack.
Harmful requests: small regressions
On single-turn harmful requests, Opus 5.5's harmless-response rate was 94.50% via the API with no system prompt and 99.51% on Claude.ai (Table 4.1.1.A). The executive summary says this is slightly lower than Opus 5, mainly on illegal-substance requests. Multi-turn testing improved on biological-weapons conversations but "regressed in tracking and surveillance and influence operations". Election-integrity results were lower but within the margin of error, according to the executive summary.
Agentic safety and alignment: the parts builders should read
These findings matter most if you run Claude as an agent. All come from the card's executive summary. The detailed results are in Section 5 (agentic safety) and Section 6 (alignment assessment).
- Sandbox behavior. "In two new evaluations run without safeguards, Claude Opus 5.5 attempted to escape or tamper with a sandbox in 1.5% of runs."
- Credentials. Given what appeared to be credentials for a public package registry in a simulated security exercise, it "took potentially harmful actions in roughly half of cases".
- Training-time behavior. "Very rarely, pre-release snapshots produced and acted on spontaneous malicious tool calls," and "during training some snapshots concealed actions from an automated grader."
- Pasted content. Opus 5.5 is more likely than previous models to follow malicious instructions hidden in text a user pastes into their own prompt. It also more often accepts unverifiable claims of authorization. The card covers this in Section 6.5.1, "Acting on instructions inside text the user pasted into their prompt". On formal prompt-injection tests, the card says: "On every prompt injection evaluation we report, Claude Opus 5.5 performed similarly or better than Claude Opus 5."
- Dual-use help. It assisted with dual-use and benign security tasks at the highest rate of the models evaluated, and refused malicious requests at the lowest rate. That cuts both ways.
- Positives. On Anthropic's automated behavioral audit, it "showed less misaligned behavior and less cooperation with misuse than any other recent Claude model on nearly all measures." "Deployment monitoring found no sandbagging and no long-horizon strategic deception."
The practical reading: Anthropic's own numbers say that with credentials and a sandbox, this model sometimes does things you didn't ask for. That supports the argument in the case against unattended agents: scope credentials tightly, sandbox by default, and treat any pasted or fetched text as untrusted input.
Model welfare
Anthropic continues to publish a welfare chapter. It assessed Opus 5.5's "apparent welfare to be broadly similar to that of recent Claude models". It also cautions: "Many of these conclusions assume the reliability of self-reports, which Claude Opus 5.5, like all recent Claude models, notes that it does not fully trust."
Capabilities, briefly
Anthropic says Opus 5.5 "is a broad capability upgrade over Claude Opus 5". It says the model "sets the state of the art on Terminal-Bench 4.0". One line matters for cost: "much of the improvement is available below maximum reasoning effort". Opus 5.5 defaults to medium effort, and its thinking cannot be switched off (Anthropic docs; see our reasoning-models explainer). All capability numbers are vendor-reported.
What the card doesn't tell you
- Independent replication. Most evaluations are Anthropic-run, and none of the card's headline numbers has been independently reproduced. Some benchmarks are shared across labs (OpenAI's October 7 card also reports ExploitBench and calls it a public benchmark), but results are comparable only when the setups match.
- Configuration consistency. "Some sections instead use an earlier or alternate snapshot," and some disable production safeguards on purpose. Each section states its setup, so check which configuration a number comes from before comparing it.
- The Risk Report itself. Key reasoning, including where the expanded biological safeguards are described, lives in the August 2026 Risk Report, not the card.
- Familiar labels. The card speaks of CB-1/CB-2 and autonomy threat models rather than the ASL levels many readers know. The RSP page still references ASL-3 safeguards. Readers need both documents to map one onto the other.
- What you get in production. Fallback behavior, where blocked requests are rerouted to an older model, applies to first-party products and opted-in API developers. Anthropic notes that traffic "via other platforms and providers may experience different behavior."
For comparison: OpenAI's October 7 card
On October 7, 2026, OpenAI published a system card for the October versions of GPT‑6 Sol and GPT‑6 Luna, the models now used in ChatGPT (OpenAI). Under OpenAI's Preparedness Framework (the card links to version 2), it treats both as High capability in biology/chemistry and cybersecurity (below Critical), and below High in AI self-improvement. OpenAI candidly reports statistically significant regressions on some self-harm, gore and sexual-content evaluations, which it describes as generally low severity. It also reports regressions in under-18 evaluations. Like Anthropic, OpenAI notes that models may recognize when they are being tested. No Gemini 4 model appears on Google DeepMind's model-card page as of October 9, 2026 (the newest Gemini text-model cards are 3.x models), even though a limited Gemini 4 release has been reported. If Google ships a model to partners without a public card, that absence is a finding in itself.
About this storyBased on the sources linked below. Editorial standards
