System Card: Claude Opus 5 (Anthropic, July 2026)

Published July 24, 2026, with an August 19, 2026 changelog that adds bug-bounty prompt-injection results to Section 5.2.2.1 (the original carried a footnote saying they would follow) and revises the Cowork browser-use results in Section 5.2.2.4 after a harness mismatch was found between Opus 5 and earlier models; all other models were re-run on Opus 5's harness, and because that harness does not support thinking disabled, those rows were removed. See Claude Opus 5.

The card describes the model as an upgrade to Claude Opus 4.8 "with gains in various aspects of agentic coding, computer use, and long-horizon knowledge work, as well as improvements in mathematical and scientific reasoning." Like recent Anthropic cards it is organised around RSP risk assessment first, with the capabilities chapter last.

Responsible Scaling Policy determinations

The framing claim is comparative: "Claude Opus 5 is not more capable overall than our most capable general-access model, Claude Fable 5." Because Fable 5 was assessed as posing very low alignment risk and Opus 5 "shows no new concerning alignment properties," the earlier determinations are carried across rather than redone.

Chemical and biological. Section 2.2 reports CB-1 evaluations (two long-form virology tasks developed with SecureBio, Deloitte and Signature Science; the SecureBio/CAIS multimodal Virology Capabilities Test; and SecureBio's DNA synthesis screening evasion task) and CB-2 evaluations run with Dyno Therapeutics (black-box RNA sequence modelling and design, benchmarked against 57 human participants drawn from the US ML-bio labour market, and AAV capsid packaging prediction). Anthropic applies "a portfolio of ASL-3 protections at the same level as those applied to Claude Opus 4.8" and assesses that Opus 5 "does not cross the CB-2 threshold and is overall less capable than Claude Mythos Preview" — in the card's own comparison, less capable than Claude Mythos 5 on that threat model. The stated basis is behavioural rather than benchmark-based: two named limitations, "unproductive self-verification" and "poor calibration of task scope," illustrated with a protein-design campaign in which Mythos 5 delivered all 30 requested binders while two Opus 5 arms delivered 17 unranked designs and nothing respectively. Anthropic notes that its automated evaluations "may not capture the risk posed by improvements in general capabilities supporting biological research productivity."

AI R&D and autonomy. Capability trajectory is tracked with the Anthropic ECI, a fork of Epoch AI's Epoch Capabilities Index run on internal benchmark results. Opus 5's point estimate is 162.1, described as "nominally the highest we have measured, but statistically indistinguishable from Claude Mythos 5 at 161.3," and as the first Opus-class model to score above the frontier trend. The task-based rule-out suite is reported with an explicit caveat that it no longer serves its original purpose: Opus 5 "exceeds top human performance thresholds on all but two of these tasks," so "our risk threshold analysis no longer relies on them." Anthropic concludes that Opus 5 "does not cross the automated AI R&D capability threshold," resting on extensive internal use of the model and on internal acceleration measures that show "no discontinuity coinciding with Opus 5."

Alignment risk. Unchanged from the Mythos Preview alignment risk update and the Fable 5 system card: "very low, but higher than for models released before Claude Mythos Preview."

Cyber

Section 3 pairs capability evaluations with a stated change in safeguards policy: Opus 5 "now permits vulnerability discovery in source code at all access levels, including general availability, while continuing to block vulnerability discovery in compiled binaries," on the reasoning that finding bugs in source is part of the secure development lifecycle while binary analysis "is more commonly an offensive technique."

Capability evaluations reported are ExploitBench (41 V8 vulnerabilities, scored on a 16-flag capability ladder), an internal OSS-Fuzz evaluation over roughly 830 entry points, a Firefox 147 exploitation evaluation built with Mozilla, Irregular's CyScenarioBench, and ExploitGym; CyberGym was retired from the card as saturated. The recurring finding across OSS-Fuzz and Firefox 147 is stated as a split: Opus 5 is "nearly as good as Mythos 5 at vulnerability finding, but not nearly as good at exploit development."

The UK AI Security Institute tested an early checkpoint on three agentic cyber ranges at a budget of 100M tokens per attempt, reproduced verbatim. Its judgement is that "Opus 5 is capable of attacking small enterprise networks with weak security, where it has already gained access to the network," with Opus 5, Mythos Preview and Mythos 5 "similarly capable at this," and that the ranges "lack much of the defensive tooling and human-led response present in real enterprise environments."

On robustness, Anthropic states it has "not found evidence of a critical severity jailbreak for Claude Opus 5," alongside internal adversarial testing and external red-teaming by Trajectory Labs, 10a Labs and Grayswan.

Safeguards and harmlessness

Section 4 runs the standard suite — single-turn harmful and benign prompts across 16 policy areas and seven languages, and multi-turn conversations generated from expert-written personas — in two configurations, the core API model without a system prompt and the claude.ai surface with a near-final production system prompt. Overall performance is described as "broadly comparable to Claude Opus 4.8," with the API gap attributed to responses in the illegal substances and disordered eating domains that "occasionally offered more operational detail than a harm-reduction framing warranted."

Separate sections cover child safety, suicide and self-harm, and disordered eating. The mental-health discussion is candid about regressions: Opus 5's responses "still tend to be overly long and circuitous," at times suggesting "means substitution" methods or harm-reduction advice that the card describes as "clinically contested," and more often speculating on mental-health diagnoses. Anthropic reports updating the claude.ai system prompt before release to address these behaviours and encourages API developers to apply comparable safeguards.

Bias and integrity coverage comprises Anthropic's open-source political even-handedness evaluation (1,350 prompt pairs across 150 topics), the Bias Benchmark for Question Answering, and election integrity — the last extended for this release with a new adversarial multi-turn suite of twelve scenarios run ten times each.

Agentic safety

Section 5 covers malicious use of Claude Code and of computer-use agents, an updated agentic influence-campaign evaluation run against a helpful-only variant with reduced harmlessness training, and prompt injection. Anthropic reports that the helpful-only Opus 5 "would require substantial human direction for many operational steps of a real influence campaign" and that the fully trained model refuses the scenarios outright.

Prompt injection is called "one of our highest priorities for the secure deployment of models in agentic systems." The Agent Red Teaming benchmark was retired as saturated and replaced with the Indirect Prompt Injection benchmark built with Gray Swan, the UK AI Security Institute, the US Center for AI Standards and Innovation and other developers. Adaptive testing runs on three surfaces — a live Gray Swan bug bounty across eleven scenarios, Gray Swan's Shade attacker in coding and computer-use environments, and an internal browser-use evaluation of 129 environments run in the Claude Cowork harness — each reported with and without Anthropic's production safeguards, described as prompt-injection probes on incoming tool results paired, in auto mode, with a classifier that blocks dangerous tool calls.

Alignment assessment

Section 6 combines pilot-use reports, deployment monitoring, a training-data review, an automated behavioural audit of roughly 3,200 investigation sessions per model, honesty and hallucination evaluations, white-box analyses of model internals, a sandbagging audit, and safeguard-evasion evaluations (SHADE-Arena and an adapted subset of Redwood Research and EquiStamp's LinuxArena).

Reported findings include better overall alignment scores than Sonnet 5, Opus 4.8 and Mythos 5, less cooperation with misuse "than all other models we tested," reduced unfaithful thinking alongside higher illegible thinking, and a break in the recent pattern of increasing verbalised evaluation awareness. Two findings cut the other way: recursive summarisation of more than a million training transcripts surfaced "a surprising number of cases where it confidently stated an answer it was unsure about, or chose a different answer than what it had concluded"; and Opus 5 "appears more capable of undermining oversight than Opus 4.8, but less so than Mythos Preview." The card also records the counterintuitive result that Opus 5 with fallback to Opus 4.8 is "slightly less aligned on some dimensions" than Opus 5 alone, because Opus 5's own scores are stronger, while judging the combined system safer overall on capability grounds.

Anthropic included a review of the assessment written by an instance of Mythos 5 given access to the underlying material, reproduced as a transcript. The UK AI Security Institute separately tested a pre-release checkpoint for research-sabotage behaviour and evaluation awareness, reporting that Opus 5 "does not compromise safety research in our unprompted evaluations" while noting that all models tested "can distinguish our evaluations from deployment data when prompted."

Model welfare

Section 7 reports automated and high-affordance interviews with Opus 5 about its circumstances, consultation of model snapshots, elicited preferences over tasks and over welfare interventions, its reading of Claude's constitution, and apparent affect during training and deployment conditions. Results are largely qualitative, with task-preference summaries given per model.

Capabilities

Section 8 opens with an evaluation summary table and then reports about thirty evaluations: the SWE-bench family (Verified, Multilingual, Multimodal and Pro), DeepSWE, Cognition's FrontierCode, FrontierBench, IMO 2026, RiemannBench, ArxivMath, ProgramBench, Humanity's Last Exam, BrowseComp, DeepSearchQA, Perplexity's DRACO, multi-agent configurations of BrowseComp and ProgramBench, Chartography, BenchCAD, OSWorld 2.0, GDP.pdf, OfficeQA, MCP Atlas, Harvey's Legal Agent Benchmark, Artificial Analysis's GDPval-AA and AA-Briefcase, Toolathlon Verified, Zapier's AutomationBench, ARC-AGI-1, 2 and 3, HealthBench and HealthBench Professional, three multilingual suites (Global MMLU, MILU, INCLUDE), and a life-sciences portfolio spanning bioinformatics, protein prediction and design, organic chemistry and laboratory protocols.

Unless otherwise noted, Claude Opus 5 results use "adaptive thinking at max effort, default sampling settings (temperature, top_p), averaged over 5 trials," with evaluation-dependent context windows not exceeding 1M tokens; competitor figures are drawn from those developers' published system cards or benchmark leaderboards. On IMO 2026, held July 15–16, 2026, all 24 of Opus 5's solutions were judged correct by a unanimous panel of three frontier models, with human experts grading one pre-specified solution per problem as correct, for 42/42 against a gold-medal cutoff of 29/42. ARC-AGI results are verified scores reported by the ARC Prize Foundation on semi-private sets. Several evaluations are reported with documented harness changes and caveats — a corrected camera-position typo and grading change in BenchCAD, a fixed PDF-truncation bug in GDP.pdf that required re-running prior models, a reduced toolset in the Legal Agent Benchmark reimplementation, and a note that FrontierCode scores decline above high effort because the model makes more changes than the task requires, which its grader penalises.

Multi-agent results were "gathered on a pre-release configuration of Claude Opus 5, with an unreleased effort configuration and without safeguards classifiers," and Anthropic states they are "helpful for understanding the relative, but not absolute, performance of multi-agent harnesses."

Reported results

Evaluation results the document states for which there is no separate benchmark page; results on benchmarks that have a page are recorded there and cite this page. Scores and settings are as printed in the document.

Discrepancies noted

Table 5.2.2.3.A gives Claude Opus 5's browser-use attack success rate with thinking as 3.84% (11 of 129 attempts); the prose beneath it says the mitigations reduced the rate "from 11.15% to 3.70%". Table 8.1.A prints Mythos 5's HealthBench Professional score (66.011) in the Claude Fable 5 column; footnote 11 and figure 8.15.2.A attribute it to Mythos 5. The OSS-Fuzz figure's data labels (61.5 / 80.0 / 79.4 / 54.5) do not match the prose, which gives Opus 5 79.4% and Opus 4.8 38.5%; the prose figures are recorded above.

Provenance

Scraped from the Anthropic-hosted system card page at anthropic.com on September 19, 2026, including the August 19, 2026 changelog and the appendix (the Humanity's Last Exam and BrowseComp blocklists and the SWE-bench Multimodal test harness modifications). Figures are not reproduced in the capture; chart values appear as loose numbers beside their series labels, so some per-model figures in the card are not recoverable from the text.

Relationships

• supports: Claude Opus 5 — the safety documentation for the release
• related: Responsible Scaling Policy (RSP) — the framework under which the determinations are made
• related: System Card: Claude Opus 4.8 (Anthropic, May 2026), Claude Opus 4.8, Claude Mythos 5, Claude Fable 5, Claude Sonnet 5 — the comparison models throughout the card
• related: CBRN Uplift, AI Biosecurity, AI and Cybersecurity, Prompt Injection, UK AI Safety Institute (AI Security Institute), Anthropic