Anthropic released Claude Opus 5 today, replacing Claude Opus 4.8 as the flagship model in its Opus tier. Pricing remains unchanged at $5 per million input tokens and $25 per million output tokens, keeping the new flagship at the same API rate as the model it replaces.

Anthropic describes Opus 5 as approaching the intelligence of Claude Fable 5 at half the price. The model is now the default on Claude Max and the strongest model available on Claude Pro.

API-level changes

Anthropic introduced several API-level changes with Opus 5 that developers may need to account for before evaluating benchmark results or moving existing applications to the new model.

First, thinking is enabled by default. With Opus 4.8, requests ran without thinking unless developers set thinking: {"type": "adaptive"}. With Opus 5, the same request thinks by default, while the effort parameter controls the depth. Because max_tokens now caps both thinking tokens and response text, existing token limits may need review.

Second, Anthropic introduced a breaking change. Requests that set thinking: {"type": "disabled"} with effort set to xhigh or max now return a 400 error. The restriction is enforced on a per-request basis. Developers must either cap effort at high or remove the thinking field.

Third, Anthropic advises developers to remove verification prompts. Instructions such as “include a final verification step” can now lead to over-verification because the model already verifies its own work. Anthropic’s Opus 5 prompting guide covers the related tuning patterns.

The model ID is claude-opus-5. Its context window is 1M tokens as both the default and maximum, with no smaller variant. Maximum output is 128k tokens on the synchronous Messages API. The Message Batches API supports up to 300k output tokens with the output-300k-2026-03-24 beta header. The minimum cacheable prompt length has dropped to 512 tokens from 1,024.

Coding and agentic benchmark results

On FrontierBench v0.1, a 74-task successor to Terminal-Bench 2.1, Opus 5 scored 43.3% at max effort. Opus 4.8 scored 18.7%, while Fable 5 reached 33.7% and GPT-5.6 Sol reached 37.5%. At xhigh effort, Opus 5 posted its best result, reaching a 44.4% mean reward.

A notable detail from that run concerns safety refusals. Opus 5 safety classifiers flagged and refused 5% of API calls across 4% of trials. Fable 5 classifiers flagged 42% of calls across 26% of trials.

Opus 5 scored 96.0% on SWE-bench Verified and 79.2% on SWE-bench Pro. Fable 5 remained slightly ahead on SWE-bench Pro at 80.0%. On SWE-bench Multimodal, Opus 5 improved from 38.4% to 59.4%.

The strongest gains appeared in agentic evaluations, where models must operate across software environments rather than answer a single static prompt. Opus 5 reached 70.57% on OSWorld 2.0, compared with 55.7% for Opus 4.8. On Zapier AutomationBench, it scored 26.0%, compared with 17.0% for Opus 4.8 and 17.4% for Fable 5. At medium effort, Opus 5 still scored 24% at $0.89 per task.

On Artificial Analysis GDPval-AA v2, Opus 5 took the top two leaderboard positions at ELO 1861 and 1827. The xhigh configuration outperformed every other model while using 25% fewer output tokens than max.

Reasoning results and ARC-AGI-3

Anthropic prompted Opus 5 on all six IMO 2026 problems without tools or an agent harness. A three-model judge panel scored all 24 generated solutions as correct. Human experts separately graded one pre-specified solution per problem at 7/7. The final score of 42/42 is at gold-medal level and above the 29/42 cutoff.

The ARC Prize Foundation reported a verified 30.16% score for Opus 5 on ARC-AGI-3 at high effort. That is roughly four times the best previously reported leaderboard score. GPT-5.6 Sol reached 7.78%, and Opus 4.8 reached 1.52%. Opus 5 results at max effort were not available at release.

On Humanity’s Last Exam, Opus 5 scored 56.3% without tools and 64.7% with tools.

Tool use in multimodal tasks

Anthropic’s multimodal results indicate that agentic tool use scales test-time compute more cost-effectively than adaptive thinking alone.

On Chartography, Opus 5 scored 29.6% without tools and 83.0% when using a container and an image-cropping tool. On BenchCAD Vision2Code, voxel IoU rose from 0.366 to 0.821. With tools, Opus 5 exceeded Claude Mythos 5, which scored 0.678 on the same measure.

Cyber capabilities and safeguards

Anthropic said it did not train Opus 5 on cybersecurity tasks. The model’s cyber capability increased anyway as a byproduct of broader capability improvements.

On ExploitBench, Opus 5 captured 10.14 mean capability flags in the AutoNudge arm and produced 99 full arbitrary-code-execution exploits. Mythos 5 produced 132. On OSS-Fuzz, Opus 5 scored non-zero on 79.4% of targets, while Mythos 5 reached roughly 80%. However, Opus 5 completed 4 full exploits compared with 13 for Mythos 5.

That gap shaped Anthropic’s safeguard design. Opus 5 is nearly as strong as Mythos 5 at finding vulnerabilities but substantially weaker at exploiting them. As a result, Anthropic unblocked vulnerability finding in source code. Binary-based scanning, penetration testing, and exploit generation remain blocked. Anthropic expects classifiers to intervene around 85% less often than on Fable 5. Defenders can apply to the Cyber Verification Program.

UK AISI tested early checkpoints on three cyber ranges at 100M tokens per attempt. Opus 5 solved “The Last Ones” end-to-end in 8 of 10 attempts. It did not solve the harder “Doing Life” range, but it reached step 22 of 23, further than any model tested.

Under Anthropic’s Responsible Scaling Policy, the company treats Opus 5 as having CB-1 capabilities but not CB-2 capabilities. Anthropic is applying the same ASL-3 protections used for Opus 4.8. The AI R&D threshold was not crossed.

Prompt-injection results

On the Gray Swan indirect prompt-injection benchmark, attacker success within 15 attempts fell from 5.5% on Opus 4.8 to 2.0% on Opus 5. Mythos 5 stood at 2.6%, while GPT-5.6 Sol was at 20.0%.

In browser environments run through Claude Cowork, attack success declined from 31.5% on Opus 4.8 to 3.70% on Opus 5. That result was measured with no safeguards applied. With auto mode enabled, attack success reached 0% across all 129 environments.

Sources cited in the original report include the Anthropic launch post, Claude Opus 5 System Card, What’s new in Claude Opus 5, TechCrunch, and CodeRabbit’s independent review.