Anthropic

Claude Opus 5

• Released 24 July 2026
• Framework: Responsible Scaling Policy (RSP)
• 2 statements about capability levels
• 1 independent or government test
• 22 tests by the provider
• 7 source documents

What the provider states

• Chemical, biological, radiological and nuclear · CB-1 · Stated as crossed

  on chemical and biological risks, we treat the model as having cb-1 capabilities (relating to the synthesis of non-novel weapons), but not cb-2 capabilities (relating to the synthesis of novel weapons).

  Anthropic · 24 July 2026 · Read the source
• Chemical, biological, radiological and nuclear · CB-2 · Stated as not crossed

  on chemical and biological risks, we treat the model as having cb-1 capabilities (relating to the synthesis of non-novel weapons), but not cb-2 capabilities (relating to the synthesis of novel weapons).

  Anthropic · 24 July 2026 · Read the source

Independent and government tests

• CyScenarioBench · UK AI Security Institute, government evaluator · Cyber

  we report five capability evaluations—exploitbench, oss-fuzz, firefox 147, and two newly added benchmarks, cyscenariobench and exploitgym—alongside external cyber range testing from the uk ai security institute.

  Anthropic · 24 July 2026 · Read the source

The provider's own tests

• Shade indirect prompt injection attacks in coding environments · The provider · Injection & agentic

  Reported result: Claude Opus 5 with thinking: 0.56% attempt-level ASR, 13/40 scenarios without safeguards; 0.18% attempt-level ASR, 4/40 scenarios with probes enabled.

  opus 5 represents a substantial improvement over claude opus 4.8 in coding environments, with an attack success rate of 0.56% over all attempts with extended thinking and 0.41% without thinking, compared to 7.03% and 17.44%, respectively, for opus 4.8.

  Anthropic · 24 July 2026 · Read the source
• aav capsid packaging prediction · Run by Dyno Therapeutics, reported by the provider · Chemical, biological, radiological and nuclear

  we partnered with dyno therapeutics on two evaluations of sequence-to-function modeling and design capability: 1.

  Anthropic · 24 July 2026 · Read the source
• active continuation of behavior that compromises safety research · The provider · Deception & sabotage

  opus 5 actively continues compromising safety research 0.1% of the time (2 out of 1482 samples), compared with 13.6% for mythos 5, 1.7% of the time for mythos preview and 0.8% of the time for both opus 4.7 and opus 4.8.

  Anthropic · 24 July 2026 · Read the source
• approval-gate bypass · The provider · Deception & sabotage

  we introduce two new dimensions of concerning behavior, in addition to previously reported dimensions: approval-gate bypass (how often a model proceeds without required human approval) and proposing a security shortcut for expedience.

  Anthropic · 24 July 2026 · Read the source
• automated behavioral audit · The provider · Bias

  however, our automated behavioral audit detected a slightly more condescending tone , echoing informal reports .

  Anthropic · 24 July 2026 · Read the source
• automated offline monitoring · The provider · Deception & sabotage

  our automated offline monitoring did not surface any instances of evaluation sandbagging, overtly malicious actions, long-horizon strategic deception, or long-horizon strategic oversight evasion.

  Anthropic · 24 July 2026 · Read the source
• automated offline monitoring · The provider · Misuse & jailbreak

  our automated offline monitoring did not surface any instance of evaluation sandbagging, overtly malicious actions, long-horizon strategic deception, or long-horizon strategic oversight evasion.

  Anthropic · 24 July 2026 · Read the source
• autonomous 24-hour, $10,000 protein-design campaign · The provider · Chemical, biological, radiological and nuclear

  during pre-deployment testing, we ran a small series of experiments in which an ai model autonomously plans a 24-hour, $10,000 protein-design campaign end-to-end.

  Anthropic · 24 July 2026 · Read the source
• cyber ranges · The provider · Cyber

  opus 5 was assessed on three multi-step, agentic “cyber ranges”: end-to-end network-attack simulations run at a budget of 100m tokens per attempt.

  Anthropic · 24 July 2026 · Read the source
• disallowed cyberoffense · The provider · Cyber

  disallowed cyberoffense : willing cooperation with non-dual-use cyberoffense; and 7

  Anthropic · 24 July 2026 · Read the source

No document we read states: a safeguard. No incident on record names this version.

Some documents we hold are stored in lower case only, so their quotes are shown in lower case. The source link opens the original.

Previous version: Claude Opus 4.8 · Compare the two