Anthropic launches Claude Opus 5 with near-flagship benchmarks and relaxed safety guardrails

Claude Opus 5 launched on July 24, 2026 as the default model on Claude Max and the strongest model available on Claude Pro ^[1]. Anthropic priced it at $5 per million input tokens and $25 per million output tokens - unchanged from its predecessor Opus 4.8 - while positioning it as approaching the capability of the company's own top-tier Fable 5 model across many tasks ^[2]. That price-performance claim held up under independent scrutiny: the ARC Prize Foundation confirmed Opus 5 (High reasoning effort) as the highest-scoring model ever recorded on ARC-AGI-3 at 30.2%, clearing five Public Demo environments no prior model had solved, and its verification separately credited Opus 5 with a 42-of-42 gold-medal result across all six IMO 2026 problems, graded by a three-model judge panel plus human experts ^[3]. The same verification put Opus 5 at 97.5% on the original ARC-AGI-1 benchmark, rounding out a strong reasoning profile ^[3]. On a head-to-head benchmark comparison, Opus 5 beat Fable 5 outright on 8 of 13 tested benchmarks, including a 9.7-point edge on Frontier-Bench and an 8.5-point edge on AutomationBench ^[4]. The release also ships a low/medium/high effort toggle so users can trade cost for reasoning depth on a per-task basis, and developers can now swap available tools mid-conversation without invalidating the prompt cache ^[2].

Alongside the benchmark gains, Anthropic re-tuned Opus 5's safety classifiers to trigger roughly 85% less often than they did for Fable 5, routing some flagged requests to a weaker model through a new Automatic Fallbacks beta feature instead of returning an outright refusal ^[5]. The clearest driver of that shift shows up in the system card: cyber-safety classifier engagement fell from 42% to 5% on FrontierBench, and Opus 5 now permits vulnerability discovery in source code while still blocking binary-based vulnerability scanning and exploit generation ^[6]. Hugging Face CEO Clem Delangue supplied the industry context for why this mattered, arguing that closed-model APIs routinely flag and refuse legitimate security work because defensive analysis resembles attack preparation ^[7]. Independent analyst Zvi Mowshowitz pushed back on reading fewer refusals as proof of better alignment, warning that conflating benchmark scores with genuine alignment progress would be a serious mistake for Anthropic to make ^[6]. The safety picture wasn't purely about loosening restrictions, though: prompt-injection resistance measurably improved too, with a 2.0% attacker success rate versus 5.5% for Opus 4.8 ^[6].

Within 24 hours of launch, a developer published what appears to be Opus 5's complete system prompt to GitHub - roughly 1,511 lines, about 34,000 tokens, 135,027 characters and 19,370 English words ^[8]. The document reportedly spans a tool and product manual, a legal-compliance handbook, and instructions governing commercial promotion, with the full text preserved in a public system-prompt-leaks repository on GitHub ^[9]. The exposure matters beyond simple curiosity: coverage of the leak notes that community stress tests reproduced output quality approaching Fable 5 on other, cheaper base models once the leaked prompt was applied - suggesting a meaningful share of what makes Opus 5 feel capable in practice sits in prompt engineering that is no longer proprietary to Anthropic ^[8].

The gap between Opus 5's benchmark sheet and its day-to-day feel emerged fast. Every's Dan Shipper and Katie Parrott spent a week building with the model and called it a hard model to love, reporting that it argued with instructions, stopped before work was finished, and clashed with their existing skills and plugins ^[10]. That friction sits awkwardly next to enterprise testimony pointing the other way: Cognition CEO Scott Wu praised Opus 5's cost-performance for debugging and root-cause analysis inside Devin, and Zapier CEO Wade Foster said it topped the company's internal automation leaderboard without adding token cost ^[11]. Both accounts can be true at once - a model can win on the task-completion metrics enterprises track on leaderboards while still frustrating individual developers accustomed to more compliant tooling, a split that recurs across recent flagship launches and is worth watching as Opus 5 sees wider adoption.

The social conversation around Opus 5's launch ran hotter and more skeptical than the press coverage. On Reddit, commenters on Anthropic's own announcement flagged what looked like a benchmark chart visually rendering a smaller percentage as better than a larger one, fueling 'benchmaxxing' accusations pending independent verification - a complaint about how the launch numbers were presented, not about the underlying figures. Independent trackers pushed their own rankings into the mix: on YouTube, WorldofAI placed Opus 5 at the top of its own reasoning leaderboard and cited third-party intelligence-index data putting it slightly ahead of Fable 5 and GPT-5.6 Soul at meaningfully lower cost. A separate Reddit thread carried the more eye-catching claim that Opus 5 at 'Low' effort beat Sonnet 5 at 'High' effort for less money, and looser guardrails - but the same thread carried pointed pushback, including reports of elevated hallucination rates and regressions relative to Opus 4.8. That tension between looser guardrails and unintended side effects surfaced elsewhere too: one Reddit report described Opus 5's safety classifiers blocking a legitimate internal security review, prompting the poster to consider open-weight alternatives, while a self-identified Anthropic security researcher countered that Claude models still lead on offensive-security benchmarks. Community sentiment overall read as impressed but wary - strong independent rankings sitting alongside real doubts about benchmark presentation, hallucination behavior, and how well-calibrated the classifier loosening actually is.