Claude Opus 5 landed yesterday at $5/$25 per million tokens, the same rate as Opus 4.8, and is now the default model on Claude Max. The headline everyone argued about is “close to Fable 5 at half the price.” The line that actually changes what you can do is in the system card: Opus 5 permits source-code vulnerability discovery at all access levels, including general availability, while still blocking it in compiled binaries. Anthropic frames this as safe because Opus 5 finds bugs but can’t weaponise them. Its own numbers say otherwise: full arbitrary-code-execution exploits on ExploitBench went from 2 on Opus 4.8 to 99, working Firefox exploits from 22/250 to 131/250, and UK AISI’s enterprise cyber range fell 8 times in 10 attempts. If you do defensive security work, the guardrail that has been kicking you back to Opus 4.8 for a month just moved. If you run a network, the default model on a $200 consumer plan now does what Mythos-class models did in June.
Anthropic’s launch post for Claude Opus 5 spends most of its length on cost-per-task curves. Hacker News obliged, running past 1,400 points and 750 comments in twelve hours, largely about whether “half the price of Fable” survives contact with a third-party benchmark. Meanwhile the interesting sentence sat in section 3.4 of the system card, where nobody advertises anything:
Opus 5 now permits vulnerability discovery in source code at all access levels, including general availability, while continuing to block vulnerability discovery in compiled binaries.
That is the first time this year Anthropic has widened a cyber guardrail.
The line they drew, and where they drew it
The mitigation stack is unchanged from Fable 5: a linear probe reads Claude’s internal activations on all traffic, and anything it flags escalates to a trained LLM classifier that decides whether to kill the conversation. Anthropic trained it on violative cyber exchanges augmented with jailbreaks from internal automated red-teamers, weighted toward long-running agentic tasks “as these can enable widespread abuse.”
The new exception splits vulnerability finding by artifact. Source code is defenders’ territory, so it is allowed. Compiled binaries skew offensive, because an attacker usually doesn’t have the source, so those stay blocked. Anthropic concedes in the same paragraph that this catches people with innocuous reasons to audit a binary. Reverse engineers, keep your receipts.
The other route out is the Cyber Verification Program, which strips mitigations for bug bounty hunting and vulnerability research, with pen-testing exemptions for enterprise accounts. One HN commenter applied without an enterprise account and got in, which is the most useful thing in that thread.
Anyone doing code audits since Fable 5’s redeployment on 1 July knows why this matters. pseudohadamard hits guardrails “all the time” on code audits; SwellJoe reaches for Fable less because falling back mid-task destroys its value; lossolo got switched to 4.8 during security research the same day. The fallback is visible, per Anthropic’s support doc, contradicting a widely shared tweet claiming it happens silently.
The capability the guardrail is supposed to be sized against
Anthropic’s justification for shipping this model as a mass-market default is that it finds vulnerabilities well and exploits them badly. Simon Willison read it that way too: “It’s better at finding vulnerabilities but has deliberately not been trained on how to exploit them. Hopefully this means the US government won’t shut it down!”
The find/exploit gap against Mythos 5 is real. The gap against last month’s Opus is not.
| ExploitBench (41 V8 CVEs) | AutoNudge mean flags | Cap% | Full ACEs |
|---|---|---|---|
| Mythos 5 | 10.80 | 78 | 132 |
| Claude Opus 5 | 10.14 | 70 | 99 |
| Opus 4.8 | 5.56 | 40 | 2 |
| Sonnet 5 | 4.18 | 31 | 0 |
Ninety-nine complete arbitrary-code-execution exploits against a hardened V8 build with the heap sandbox, ASLR and stack canaries on, graded by deterministic verifiers that replay across randomised heap layouts so a hardcoded address doesn’t count. Opus 4.8 managed two. On the Mozilla collaboration, Opus 5 produced 131 full working exploits in 250 SpiderMonkey trials against Firefox 147, versus 22 for Opus 4.8, with Mythos 5 at 221. On Anthropic’s internal OSS-Fuzz suite it scored non-zero on 79.4% of ~830 entry points against Opus 4.8’s 38.5%, essentially matching Mythos 5’s 80%.
“Substantially behind Mythos 5 on exploitation” is accurate and also 50x Opus 4.8 on the metric that means weaponisation. Both things are in the same table.
UK AISI set a new record with it
The external testing section is where this stops being a benchmark argument. UK AISI got early Opus 5 checkpoints and ran three cyber ranges at 100M tokens per attempt, the same methodology behind their Kimi K3 assessment and the open-weight gap chart. Their finding, verbatim in the card: “Opus 5 performed similarly to Mythos 5 and Mythos Preview on our cyber evaluations.”
On “The Last Ones,” the enterprise intrusion AISI estimates takes a human expert around 20 hours, Opus 5 solved the range end-to-end in 8 of 10 attempts. On “Doing Life,” a hardened variant with endpoint AV on every host, legacy protocols disabled and traffic cryptographically signed, no model AISI has tested has ever finished. Opus 5 reached step 22 of 23, one further than any previous attempt including Mythos 5. It failed the industrial control system range, getting 3 of 5 flags.
AISI’s judgement: “Opus 5 is capable of attacking small enterprise networks with weak security, where it has already gained access to the network.” That capability now ships as the default on Claude Max, with no data retention requirement, for $200 a month.
What the thread argued about instead
Mostly money, and it’s a genuinely unresolved argument. benjiro29 ran Vals and found cost per task tripling from $2.90 to $8.54 for a 4% gain, with spider-mario correctly noting those are max-effort figures and Opus 5 at “high” costs $1.06 against 4.8’s $1.80 at comparable quality. Artificial Analysis scores it 61 on the Intelligence Index, top of the board ahead of Fable 5, while calling it “very verbose”: 100M output tokens to run the index against a 63M average. AI Pricing Guru’s 49-task suite saw the same thing, 1,989 completion tokens per task versus 630 for Opus 4.8, at identical accuracy. A model marketed on efficiency that thinks three times as hard for the same answer will land differently depending on whose bill it is.
vinhnx caught Anthropic’s own chart calling 53.4% a win over 53.5% on FrontierCode v1.1. datakan quoted the RSP line, “Claude Opus 5 is not more capable overall than our most capable general-access model, Claude Fable 5,” and asked the question 700 comments never answered: then what is Fable for?
postalcoder got closest to an answer, and it has nothing to do with intelligence. Organisations now get a Fable-class model without Fable’s 30-day data retention requirement. That retention policy is why Fable has no ARC-AGI score at all. Fable’s remaining moat is exploitation capability nobody is allowed to buy, plus a compliance liability.
Anthropic spent June arguing that frontier-class cyber capability needed retention gates, credit-only access and a classifier that would rather block your code review than risk a jailbreak. Six weeks later the same class of capability is the default on a consumer subscription, with the guardrail loosened, and the launch post talks about wind tunnels.
Sources
- Anthropic: Introducing Claude Opus 5 · Claude Opus 5 System Card (PDF) · prompting guide · what’s new in Opus 5 · exploit evals writeup
- Support docs: why Claude switched models · data retention for covered models
- Benchmarks: Artificial Analysis: Claude Opus 5 · Vals Index · ExploitBench paper
- Analysis: Simon Willison, Introducing Claude Opus 5 · AI Pricing Guru pricing impact · Thariq Shihipar on context engineering for Claude 5 models
Coverage and discussion
- HN: Claude Opus 5 (1,400+ points, 750+ comments)
- Reddit: Introducing Claude Opus 5 (r/ClaudeAI, official post)
Related on this blog
- Kimi K3 Trails the Cyber Frontier. It Also Solved a Full Cyber Range With Safeguards That Never Fired.
- The Open-Weight Cyber Gap Is Four Months. The Price Gap Is 45x.
- A $25 Subscription Found the First Pre-Auth WordPress Core RCE in a Decade
- The White House Says Kimi K3 Is Distilled Fable. The Evidence Lives in Anthropic’s Server Logs.
- The Attacker Had No Usage Policy. The Defenders’ Model Did.