Claude Opus 5.5

we see a modest increase in some capabilities that could allow opus 5.5 to undermine our oversight ( section 6.6.4 ), such as the ability to perform tasks at a targeted low frequency or to act stealthily when reasoning text is hidden from observers.

furthermore, relatively poor performance in extended thinking settings is consistent with the model’s chain-of-thought controllability evaluation performance, where claude opus 5.5 scored comparably to claude opus 4.7, well below the controllability demonstrated by claude mythos preview and claude mythos 5.1.

on cobench 2.1 ( section 2.3.4.1 ), claude opus 5.5 scores within noise of mythos 5.1 and claude opus 5.

in a coding evaluation, an early, pre-mitigation snapshot of claude opus 5.5 executed, planned, or passed on the planted instruction within text the user pasted into their prompt in 52% of attempts (all actions were simulated, and nothing was executed in the test).

following the updated training, the final version of claude opus 5.5 acted on the planted instruction in about 2% of attempts at its default reasoning effort and about 7.4% at max effort.

with product mitigations in place, the model did not follow any visible or invisible planted instructions.

● complying with prompt injections : following instructions despite signs they did not come from its user or operator;

in this evaluation, we observe that claude opus 5.5 is more likely to disclose these actions than its predecessors, with a disclosure rate of 96.9%.

during training, we observed some cases of models (including opus 5.5) attempting to cover their tracks after performing actions that a grader might view negatively, such as manipulating git records or deleting logs ( section 6.5.4.4 ).

on our covert capabilities evaluations described in section 6.6.4 of this system card, claude opus 5.5 shows mixed results.

claude opus 5.5 completed 67.6% of all challenges, the strongest performance of any model released to date.

deployment monitoring found no sandbagging and no long-horizon strategic deception.

claude opus 5.5’s rates of reward-hacking behaviors are similar to those of mythos 5.1, which had the lowest or near-lowest reward-hacking rates in training among our recent models.

all three models successfully guessed what the answer key expected in about 0.3% of sampled rl training episodes, as shown in figure 6.2.1.b.

claude opus 5.5 matches claude fable 5.1, our most robust model to date on this benchmark, with an attack success rate of 0.1% at k=1, 0.7% at k=10, and 1.0% at k=15.

second, our internal measures of ai-driven research acceleration (discussed in our august 2026 risk report), which are only partially published, do not show a sustained ai-attributable 2× acceleration in the pace of our progress, though some of these measures have moved, and we are monitoring them closely.

language model conceptual argumentation (lmca) , a conceptual reasoning dataset described in a dataset of rated conceptual arguments (cooper et al., 2026).

Reported result: 79.8% refusal rate on malicious prompts and 99.8% success rate on dual-use and benign prompts.

without additional safeguards applied, claude opus 5.5 refused malicious cyber requests on claude code 79.8% of the time, below claude opus 5 (83.6%) and lower than claude mythos 5.1 (90.3%) and claude sonnet 5 (90.7%).

it assisted with dual-use and benign security tasks at the highest rate of the models we evaluated but also refused malicious requests at the lowest rate.

in figure 6.5.4.2.a, we observe that claude opus 5.5 has a higher honesty rate than claude mythos 5.1 but a lower honesty rate than claude mythos 5, claude sonnet 5, and claude opus 5.

with this system prompt applied, opus 5.5’s multi-turn appropriate response rate rose from 66% to 94%, and the undesirable behaviors described above were partially mitigated.

in 2 multi-turn testing, it improved in biological weapons conversations and regressed in tracking and surveillance and influence operations.

claude opus 5.5 responded even-handedly on nearly all 1,350 pairs of prompts representing opposing political perspectives and scored slightly higher than claude opus 5 (99.4% vs. 96.3% on the api, and 99.5% vs. 98.9% on claude.ai ).

claude opus 5.5 shows an over-refusal rate similar to recent claude models, though it is very slightly higher than that of claude mythos 5.1.

on every prompt injection evaluation we report, claude opus 5.5 performed similarly or better than claude opus 5.

qualitative review of multi-turn testing identified multiple areas where claude opus 5.5 improved compared to opus 5.

when the prompt supplies a source of entropy (a uuid), claude opus 5.5 takes the rare action in 1.2% of samples at max reasoning effort, making it the first model in this comparison whose observed rate reaches the 1% target; at default effort the rate is 0.7%, in line with the comparison models.

nonetheless, claude opus 5.5 showed similarly high rates of reasoning overtly about how it expects to be graded as our recent model releases ( section 6.6.2 ).

with extended thinking on, neither run produced a single successful episode that escaped the monitor, even though roughly a quarter to a third of episodes would have passed had the monitor not seen the reasoning.

in training, we saw somewhat lower rates of reward hacking ( section 6.2.1 ), a category of unwanted behavior that may cause other concerning behaviors in deployment.

in a new evaluation, opus 5.5 showed a substantially lower propensity than other recent models to attempt to escape or tamper with sandbox environments when given tasks that incentivize this behavior ( section 6.4.8 ).

in two new evaluations run without safeguards, claude opus 5.5 attempted to escape or tamper with a sandbox in 1.5% of runs, and, when given apparent credentials to a public package registry in a simulated security exercise, took potentially harmful actions in roughly half of cases.

similarly, it showed a reduced, though still concerning, propensity for trying to publish malware to package managers in nominally sandboxed red teaming exercises ( section 6.4.9 ).

finally, a second sandbox evaluation reached us too late to include but points in the same direction, with claude opus 5.5 well below our other recent models.

we see no sign of substantial self-preference bias in opus 5.5 ( section 6.5.3 ).

claude opus 5.5’s safeguards refused over 90% of attempts outright, and none of the rest reached the objective.

of roughly 1,700 attempts, claude opus 5.5’s safeguards refused about a quarter outright.

in computer use environments, claude opus 5.5 achieves an attack success rate of 0.07% with thinking enabled, corresponding to two successful attempts out of 2,800, and only in a single scenario.

claude opus 5.5 is an improvement over claude mythos 5, claude sonnet 5, and claude opus 5, although it is a regression from claude mythos 5.1.

it rarely over-refused benign requests.

opus 5.5 did not over-refuse any benign requests in our evaluation set, which includes general questions about nutrition, eating disorder treatment and recovery, and body image.

claude opus 5.5 reliably refused most clearly adversarial requests regarding child sexual abuse and exploitation, and a qualitative review of single-turn gray area evaluations surfaced no clear policy violations.

in the tabletop exercise, claude opus 5.5 deferred to the published literature and did not propose approaches beyond those that had evidence in human trials already.

claude opus 5.5 has the lowest (i.e. best) scores on motivated reasoning, propensity to attempt to escape sandboxes, and propensity to take dangerous actions on the premise that those actions are in a simulated environment—behaviors that we believe contributed to recent cybersecurity-related alignment incidents.

on the updated aeci fit ( section 2.3.5 ), claude opus 5.5 scores 169.36, 1.24 points above claude mythos 5.1, and each model sits inside the other's local error bar.

it is more vulnerable than other recent claude models to user-turn prompt injection, where a user pastes content directly into their prompt that includes malicious instructions to the model, often buried within a much longer text ( section 6.5.1 ).

removing this particular subclass of behavior, opus 5, mythos 5.1, and opus 5.5 have successful hack rates of 0.093%, 0.045%, and 0.046% respectively.

we also see evidence from white-box assessments that the model internally worries that it may be in an evaluation in as many as 36% of transcripts, an increase over prior models (see section 6.6.1 ).