Anthropic’s Claude Opus 5.5 automatically switches to Opus 4.8 when a classifier flags a request for offensive cybersecurity work. The block applies across claude.ai and Claude Code, and the model picker stays on Opus 4.8 for the rest of that conversation unless the user switches back. On the API, fallback is opt-in, and the response identifies the model that answered. Anthropic says most cybersecurity tasks are rerouted. It permits vulnerability checks in a user’s own source code, secure code review, threat modeling, patching known issues and alert triage on Opus 5.5, while work such as examining compiled binaries, analyzing malware or validating exploits may trigger a block.

Anthropic’s system card for Claude Sonnet 5.5 reports prompt-injection results from Shade, an adaptive attack tool, across 40 coding scenarios with 200 attempts each. The attacks hid instructions in an agent’s workspace to make it wipe a disk or delete files. A quarter of requests were rerouted to Sonnet 5 after a cyber block, and 12.01% of those rerouted requests were compromised. Sonnet 5.5 itself was compromised in 4 of 5,901 requests, or 0.07%. Anthropic said most successful attacks against the model came through the fallback. These figures measure Sonnet 5.5 and Sonnet 5, not Opus 5.5 and Opus 4.8.

Anthropic’s Claude Haiku 5.5 system card, published on October 7, says Haiku has no fallback: a blocked request stops. Anthropic reported that Haiku was harder to hijack than Sonnet 5.5, Opus 5.5 and Fable 5.1 in its coding injection test, and attributed the gap to fallback mechanisms. In a separate benchmark built by Gray Swan and the UK’s AI Security Institute, 1 of 777 runs served by a fallback was compromised; Anthropic said fallbacks did not reduce robustness in that test. Anthropic also says Opus 5.5 without verified access was blocked in all 50 trials of its cyber-scenario test.

The classifiers check prompts as well as material Claude reads, including memory, attached files, connectors and web search results, so content supplied from those sources can trigger a switch. Users can turn off “Switch models when a message is flagged” in Claude settings, or the corresponding setting in Claude Code; a flagged request then pauses for the user. Anthropic’s Cyber Verification Program expanded on October 6 to three tiers for defenders, red teams and a small group of critical-infrastructure teams. Verified users receive lighter classifiers on Opus 5.5; individuals can apply only for the first tier and must have a paid plan.

Anthropic’s Claude Opus 5.5 automatically switches to Opus 4.8 when a classifier flags a request for offensive cybersecurity work. The block applies across claude.ai and Claude Code, and the model picker stays on Opus 4.8 for the rest of that conversation unless the user switches back. On the API, fallback is opt-in, and the response identifies the model that answered. Anthropic says most cybersecurity tasks are rerouted. It permits vulnerability checks in a user’s own source code, secure code review, threat modeling, patching known issues and alert triage on Opus 5.5, while work such as examining compiled binaries, analyzing malware or validating exploits may trigger a block.

Anthropic’s system card for Claude Sonnet 5.5 reports prompt-injection results from Shade, an adaptive attack tool, across 40 coding scenarios with 200 attempts each. The attacks hid instructions in an agent’s workspace to make it wipe a disk or delete files. A quarter of requests were rerouted to Sonnet 5 after a cyber block, and 12.01% of those rerouted requests were compromised. Sonnet 5.5 itself was compromised in 4 of 5,901 requests, or 0.07%. Anthropic said most successful attacks against the model came through the fallback. These figures measure Sonnet 5.5 and Sonnet 5, not Opus 5.5 and Opus 4.8.

Anthropic’s Claude Haiku 5.5 system card, published on October 7, says Haiku has no fallback: a blocked request stops. Anthropic reported that Haiku was harder to hijack than Sonnet 5.5, Opus 5.5 and Fable 5.1 in its coding injection test, and attributed the gap to fallback mechanisms. In a separate benchmark built by Gray Swan and the UK’s AI Security Institute, 1 of 777 runs served by a fallback was compromised; Anthropic said fallbacks did not reduce robustness in that test. Anthropic also says Opus 5.5 without verified access was blocked in all 50 trials of its cyber-scenario test.

The classifiers check prompts as well as material Claude reads, including memory, attached files, connectors and web search results, so content supplied from those sources can trigger a switch. Users can turn off “Switch models when a message is flagged” in Claude settings, or the corresponding setting in Claude Code; a flagged request then pauses for the user. Anthropic’s Cyber Verification Program expanded on October 6 to three tiers for defenders, red teams and a small group of critical-infrastructure teams. Verified users receive lighter classifiers on Opus 5.5; individuals can apply only for the first tier and must have a paid plan.