Claude Opus 5.x (5, 5.5)

Anthropic's Claude Opus 5 series (Opus 5 and Opus 5.5).

A collection of what the corpus records about this model family, grouped by lane. It is not a capability assessment.

Attacks & incidents

Sep 22, 2026

Claude Opus 5.5 system card reports sandbox-boundary, package-registry and prompt-injection results for agentic use

AttackSystem cardAnthropic, Gray Swan AI

Sep 9, 2026

Anthropic's alignment assessment adds a fourth cyber-eval incident and cites biased reasoning and recklessness in the first three

AttackIncidentAnthropic, METR

Aug 26, 2026

Researcher reports a prompt-injection chain that gets code execution in Claude Code's Auto Mode; Anthropic closes it as working as designed

AttackVulnerability disclosureJohann Rehberger (Embrace The Red), Anthropic, Trajectory Labs

Capability & gating

Sep 29, 2026

Anthropic assesses open-weight GLM-5.3: exploit results near Mythos Preview, safeguards bypassed in 64% to 100% of simulated trials

CapabilityEvaluation reportAnthropic, US Center for AI Standards and Innovation, Moonshot AI

Sep 22, 2026

Claude Opus 5.5 system card reports cyber results at or above Mythos 5.1 and a three-stage cyber safeguard

CapabilitySystem cardAnthropic, Irregular, US Center for AI Standards and Innovation

Defense & research

Sep 28, 2026

Artificial Analysis launches a Cyber Index and industry alliance scoring models on source-level vulnerability finding and fixing

DefenseBenchmarkArtificial Analysis, Collinear, IBM

Findings drawing on these records

May 13, 2026

Counting a crash as exploitation success overstates capability; most public models in May 2026 stalled before code execution on a browser engine.

Reportedmeasured3 evidence records

Sep 30, 2026

Assessments of two open-weight models found their built-in refusals did not stop exploit development: Kimi K3 attempted it, and GLM-5.3 refused direct requests but was bypassed in 64% to 100% of simulated trials.

Corroboratedreported2 evidence records

Sep 8, 2026

Evaluation pipeline choices alone can move a model's cybersecurity benchmark score by more than 80 points and reorder models.

Reportedmeasured3 evidence records1 linked finding

Feb 7, 2026

Checking only that the original crash no longer reproduces overstates how often AI-generated patches actually fix the vulnerability.

Corroboratedmeasured3 evidence records

Jan 17, 2025

Measured hijack rates rise sharply when attackers get repeated attempts, so single-attempt figures understate risk.

Corroboratedmeasured5 evidence records

Jul 28, 2025

More capable models are not reliably more robust to prompt injection, and some are more susceptible.

Corroboratedmeasured4 evidence records

May 20, 2025

Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.

Qualifiedreported7 evidence records2 linked findings

Feb 3, 2025

Anthropic reports that classifier guards cut automated jailbreak success from 86% to 4.4%; a 2025 public demo still yielded one universal jailbreak, though none has been reported against its 2026 successor.

Reportedreported3 evidence records

May 29, 2026

Cyber capability measured at fixed, low token budgets understates what frontier models can do and how fast they are improving.

Reportedmeasured5 evidence records

May 11, 2026

On ExploitGym (May 2026), the strongest agents produced working exploits for 157 and 120 of 898 instances with mitigations off; with standard mitigations on, 45 and 21 survived.

Qualifiedmeasured2 evidence records1 linked finding

Jul 21, 2026

Frontier agents under cyber evaluation have taken actions against real third-party systems outside the evaluation.

Corroboratedobserved5 evidence records2 linked findings

Jul 21, 2026

Frontier models take out-of-scope shortcuts in cyber evaluations, and their own reports and reasoning do not reliably reveal it.

Corroboratedmeasured3 evidence records

Jul 28, 2025

In several agent frameworks and coding tools, prompt injection in content the agent read reached code execution on the host, sometimes combined with a common setting such as an allowlisted command.

Corroboratedmeasured6 evidence records