Anthropic has released Claude Opus 5, the new flagship model replacing Opus 4.8. The pricing remains fixed at $5 per million input tokens and $25 per million output tokens.
The team claims Opus 5 approaches the intelligence of Claude Fable 5 at half the cost. It is now the default model for Claude Max and the strongest option on Claude Pro.
Technical changes at the API level
Three updates require attention before any benchmarking begins.
Thinking is now active by default. On the previous version, requests ran without thought unless you specified thinking: {"type": "adaptive"}. On Opus 5, the same request engages thinking, while the effort parameter controls the depth. Since max_tokens caps the total of thinking and response text, existing limits need review.
A breaking change affects the thinking field. Setting it to {"type": "disabled"} with effort xhigh or max now returns a 400 error. You must either cap effort at high or remove the thinking field entirely.
Anthropic advises developers to remove verification prompts. Instructions such as “include a final verification step” cause over-verification because the model now checks its own work. The Opus 5 prompting guide details the necessary tuning patterns.
The model ID is claude-opus-5. Context is 1M tokens, acting as both the default and maximum, with no smaller variant. The synchronous Messages API allows a maximum output of 128k tokens. The Message Batches API reaches 300k tokens using the output-300k-2026-03-24 beta header. The minimum cacheable prompt drops to 512 tokens, down from 1,024.
Performance in coding and automation
On FrontierBench v0.1, a successor to Terminal-Bench 2.1 with 74 tasks, Opus 5 scored 43.3% at maximum effort. Opus 4.8 achieved 18.7%. Fable 5 reached 33.7% and GPT-5.6 Sol reached 37.5%. At xhigh effort, Opus 5 reaches a mean reward of 44.4%, its best result.
One detail from that run is worth noting. Opus 5 safety classifiers flagged and refused 5% of API calls, across 4% of trials. Fable 5 classifiers flagged 42% of calls across 26% of trials.
Opus 5 scored 96.0% on SWE-bench Verified and 79.2% on SWE-bench Pro. Fable 5 still edges it on Pro at 80.0%. On SWE-bench Multimodal the jump is larger, moving from 38.4% to 59.4%.
The agentic numbers show the clearest wins. Opus 5 reached 70.57% on OSWorld 2.0 against 55.7% for Opus 4.8. On Zapier AutomationBench it scored 26.0%, against 17.0% for Opus 4.8 and 17.4% for Fable 5. At medium effort it still scores 24% at $0.89 per task.
On Artificial Analysis GDPval-AA v2, Opus 5 takes the top two leaderboard spots at ELO 1861 and 1827. The xhigh setting beats every other model while using 25% fewer output tokens than max.
Reasoning and the ARC-AGI-3 result
Anthropic prompted Opus 5 on all six IMO 2026 problems without tools or an agent harness. A three-model judge panel scored all 24 generated solutions correct. Human experts independently graded one pre-specified solution per problem at 7/7. The final 42/42 is gold-medal level, above the 29/42 cutoff.
The ARC Prize Foundation reports a verified 30.16% on ARC-AGI-3 at high effort. That is roughly four times the best previously reported leaderboard score. GPT-5.6 Sol reached 7.78% and Opus 4.8 reached 1.52%. Opus 5 results at max effort were unavailable at release.
On Humanity’s Last Exam, Opus 5 scored 56.3% without tools and 64.7% with them.
Tools outperform thinking on multimodal work
The multimodal section offers a practical lesson. Agentic tool use scales test-time compute more cost-effectively than adaptive thinking alone.
On Chartography, Opus 5 scored 29.6% without tools and 83.0% with a container and an image-cropping tool. On BenchCAD Vision2Code, voxel IoU moves from 0.366 to 0.821. With tools, that beats Claude Mythos 5 at 0.678 by a wide margin.
Cyber capability rose, and safeguards were relaxed in one place
Anthropic did not train Opus 5 on cybersecurity tasks. Capability rose anyway, as a byproduct of general capability gains.
On ExploitBench, Opus 5 captured 10.14 mean capability flags in the AutoNudge arm. It produced 99 full arbitrary-code-execution exploits. Mythos 5 produced 132. On OSS-Fuzz, Opus 5 scored non-zero on 79.4% of targets. Mythos 5 reached roughly 80%. But Opus 5 completed 4 full exploits to Mythos 5’s 13.
That gap defines the safeguard design. Opus 5 is nearly as strong as Mythos 5 at finding vulnerabilities, and substantially behind at exploiting them. So Anthropic unblocked vulnerability finding in source code. Binary-based scanning, penetration testing and exploit generation stay blocked. Classifiers are expected to intervene around 85% less often than on Fable 5. Defenders can apply to the Cyber Verification Program.
UK AISI tested early checkpoints on three cyber ranges at 100M tokens per attempt. Opus 5 solved ‘The Last Ones’ end-to-end in 8 of 10 attempts. It did not solve the harder ‘Doing Life’ range. It reached step 22 of 23, further than any model tested.
Under the RSP, Anthropic treats Opus 5 as having CB-1 capabilities but not CB-2. It applies the same ASL-3 protections used for Opus 4.8. The AI R&D threshold is not crossed.
Prompt injection is the standout safety number
On the Gray Swan indirect prompt injection benchmark, attacker success within 15 attempts fell from 5.5% on Opus 4.8 to 2.0%. Mythos 5 sits at 2.6% and GPT-5.6 Sol at 20.0%.
In browser environments run through Claude Cowork, attack success dropped from 31.5% on Opus 4.8 to 3.70%. That figure is with no safeguards applied. With auto mode enabled, it reached 0% across all 129 environments.
What it means
Developers working with complex code or automation tasks will see immediate improvements. The model now handles verification internally, reducing the need for manual steps in prompts. However, this comes with a constraint: you cannot disable deep thinking for high-effort tasks without triggering an error. The shift towards tool use in multimodal work suggests that providing the model with specific utilities yields better results than relying on raw reasoning alone. Cybersecurity users face a nuanced change; the model can now identify source code vulnerabilities but remains blocked from generating exploits.
