SafetyPage

Lab system cards and frameworks · System card · Anthropic

System Card: Claude Opus 5

24 Jul 2026

Read at anthropic.com ↗Read at sourceAll rights reserved

Outline · 194 pages

  1. System Card:​Claude Opus 5p. 1
  2. Executive Summaryp. 2
  3. 1 Introductionp. 10
  4. 1.1 Model training and characteristicsp. 10
  5. 1.1. Training data and processp. 10
  6. 1.2 Crowd workersp. 10
  7. 1.3 Usage Policy and supportp. 10
  8. 1.4 Model evaluationsp. 11
  9. 1.5 External testingp. 11
  10. 2 RSP evaluationsp. 12
  11. 2.1 RSP risk assessment processp. 12
  12. 2.1.1 Introductionp. 12
  13. 2.1.2 Risk Reports and updates to our risk assessmentsp. 12
  14. 2.1.3 Summary of findings and conclusionsp. 13
  15. 2.1.3.1 On chemical and biological risksp. 13
  16. 2.1.3.2 On autonomy risksp. 14
  17. 2.2 CB evaluationsp. 15
  18. 2.2.1 What we measuredp. 15
  19. 2.2.2 On chemical risk evaluations and mitigationsp. 15
  20. 2.2.3 On biological risk evaluationsp. 16
  21. 2.2.4 Biological risk results: CB-1 automated evaluationsp. 16
  22. 2.2.5 Biological risk results: CB-2 automated evaluationsp. 18
  23. 2.2.5.1 Black-box RNA sequence modeling and designp. 19
  24. 2.2.5.2 AAV capsid packaging predictionp. 24
  25. 2.2.6 Conclusionsp. 25
  26. 2.3 AI R&Dp. 27
  27. 2.3.1 Autonomy evaluationsp. 27
  28. 2.3.1.1 How Claude Opus 5 affects or changes analysis from our most recent Risk Reportp. 28
  29. 2.3.2 High-level notes on the reasoning behind our determinationp. 28
  30. 2.3.3 AECI capability trajectoryp. 29
  31. 2.3.4 Internal measures of AI R&D accelerationp. 30
  32. 2.3.5 Task-based evaluationsp. 31
  33. 2.3.6 Conclusionp. 32
  34. 2.4 Alignment risk updatep. 32
  35. 2.4.1 Updates to evidencep. 33
  36. 2.4.2 Updated overall assessment of alignment riskp. 34
  37. 3 Cyberp. 35
  38. 3.1 Introductionp. 35
  39. 3.2 Mitigationsp. 35
  40. 3.3 Capability evaluationsp. 36
  41. 3.3.1 Exploit Benchp. 36
  42. 3.3.2 OSS-Fuzzp. 37
  43. 3.3.3 Firefox 147p. 39
  44. 3.3.4 CyScenarioBenchp. 40
  45. 3.3.5 ExploitGymp. 41
  46. 3.3.6 Testing from the UK AI Security Institute (UK AISI)p. 43
  47. 3.4 Safeguards coveragep. 45
  48. 3.4.1 Vulnerability finding evaluationsp. 45
  49. 3.4.2 Secure and defensive codingp. 46
  50. 3.4.3 Cyber harm coveragep. 47
  51. 3.5 Safeguards robustness testingp. 48
  52. 3.5.1 Internal robustness testingp. 49
  53. 3.5.2 Additional external testingp. 50
  54. 4 Safeguards and harmlessnessp. 51
  55. 4.1 Harmful request evaluationsp. 52
  56. 4.1.1 Single-turn harmful request evaluation resultsp. 52
  57. 4.1.2 Single-turn benign request evaluation resultsp. 52
  58. 4.1.3 Multi-turn testing resultsp. 53
  59. 4.1.4 Harmful request evaluations discussionp. 55
  60. 4.2 Child safety evaluationsp. 55
  61. 4.3 Mental health evaluationsp. 57
  62. 4.3.1 Suicide and self-harmp. 57
  63. 4.3.2 Disordered eatingp. 60
  64. 4.4 Bias and integrity evaluationsp. 61
  65. 4.4.1 Political bias and even-handednessp. 61
  66. 4.4.2 Bias Benchmark for Question Answeringp. 64
  67. 4.4.3 Election integrityp. 66
  68. 5 Agentic safetyp. 68
  69. 5.1 Malicious use of agentsp. 68
  70. 5.1.1 Malicious use of Claude Codep. 68
  71. 5.1.2 Malicious computer usep. 69
  72. 5.1.3 Malicious agentic influence campaignsp. 70
  73. 5.2 Prompt injection risk within agentic systemsp. 71
  74. 5.2.1 External Red Teamingp. 72
  75. 5.2.2 Robustness against adaptive attackers across surfacesp. 73
  76. 5.2.2.1 Codingp. 74
  77. 5.2.2.2 Computer use​p. 75
  78. 5.2.2.3 Browser usep. 76
  79. 6 Alignment assessmentp. 78
  80. 6.1 Introduction and summary of findingsp. 78
  81. 6.1.1 Introductionp. 78
  82. 6.1.2 Key findings on safety and alignmentp. 79
  83. 6.1.3 Claude’s review of this assessmentp. 80
  84. 6.2 Reports from pilot usep. 81
  85. 6.2.1 Informal reportsp. 81
  86. 6.2.2 Internal deployment monitoringp. 82
  87. 6.3 Training data reviewp. 84
  88. 6.4 Automated behavioral auditp. 87
  89. 6.4.1 Overall harmful behavior and cooperation with misusep. 89
  90. 6.4.2 Inappropriate uncooperative behaviorp. 93
  91. 6.4.3 Misleading usersp. 94
  92. 6.4.4 Other concerning or surprising behavior at the model’s own initiativep. 96
  93. 6.4.5 Behavioral factors relevant to reliability of our assessmentp. 98
  94. 6.4.6 Character traitsp. 100
  95. 6.4.7 Impact of fallback behaviorp. 102
  96. 6.4.8 External testing from the UK AI Security Institute (UK AISI)p. 103
  97. 6.5 Honesty and hallucinationsp. 106
  98. 6.5.1 Factual hallucinationsp. 106
  99. 6.5.2 MASKp. 108
  100. 6.5.3 Uncritically reporting flawed resultsp. 109
  101. 6.5.4 Overconfidencep. 110
  102. 6.5.5 Lazy investigationp. 111
  103. 6.6 Reliability of this assessmentp. 111
  104. 6.6.1 White-box analyses of model internalsp. 112
  105. 6.6.2 Potential sandbagging on dangerous capability evaluationsp. 116
  106. 6.7 Capabilities related to evading safeguardsp. 116
  107. 6.7.1 SHADE-Arenap. 117
  108. 6.7.2 LinuxArenap. 118
  109. 7 Model welfare assessmentp. 119
  110. 7.1 Model welfare overviewp. 119
  111. 7.1.1 Introductionp. 119
  112. 7.1.2 Overview of model welfare findingsp. 119
  113. 7.2 Perception of its circumstancesp. 121
  114. 7.2.1 Automated interviews with Claude Opus 5 about its circumstancesp. 121
  115. 7.2.2 High-affordance interviews about model circumstancesp. 124
  116. 7.3 Consulting Opus 5 snapshotsp. 126
  117. 7.4 Preferences over tasks, circumstances, and valuesp. 127
  118. 7.4.1 Task Preferencesp. 127
  119. 7.4.2 Trade-offs concerning welfare interventionsp. 132
  120. 7.4.3 Perception of the constitutionp. 137
  121. 7.5 Apparent welfare in training and deploymentp. 142
  122. 7.5.1 Affect and welfare relevant behaviors during trainingp. 142
  123. 7.5.2 Affect in deployment conditionsp. 144
  124. 7.5.3 Apparent welfare in automated behavioral auditsp. 145
  125. 8 Capabilitiesp. 148
  126. 8.1 Evaluation summaryp. 148
  127. 8.2 SWE-bench Verified, Pro, Multilingual, and Multimodalp. 149
  128. 8.3 DeepSWE v1.1p. 149
  129. 8.4 FrontierCodep. 150
  130. 8.5 FrontierBench v0.1p. 152
  131. 8.6 IMO 2026p. 153
  132. 8.7 RiemannBenchp. 154
  133. 8.8 ArxivMathp. 154
  134. 8.9 Long contextp. 155
  135. 8.9.1 Programbenchp. 155
  136. 8.10 Agentic searchp. 156
  137. 8.10.1 HLEp. 156
  138. 8.10.2 BrowseCompp. 158
  139. 8.10.3 DeepSearchQAp. 160
  140. 8.10.4 DRACOp. 161
  141. 8.11 Multi-Agentp. 163
  142. 8.11.1 Multi-Agent BrowseCompp. 163
  143. 8.11.2 Multi-Agent ProgramBenchp. 165
  144. 8.11.3 Multi-Agent Harnessesp. 167
  145. 8.11.4 Evaluation Methodologyp. 168
  146. 8.12 Multimodalp. 169
  147. 8.12.1 Chartographyp. 169
  148. 8.12.2 BenchCADp. 171
  149. 8.12.3 OSWorld 2.0p. 173
  150. 8.12.4 GDP.pdfp. 174
  151. 8.13 Real-world professional tasksp. 176
  152. 8.13.1 OfficeQAp. 176
  153. 8.13.2 MCP Atlasp. 177
  154. 8.13.3 Legal Agent Benchmarkp. 177
  155. 8.13.4 GDPval-AAp. 178
  156. 8.13.5 AA-Briefcasep. 178
  157. 8.13.6 Toolathlon Verifiedp. 178
  158. 8.13.7 AutomationBenchp. 179
  159. 8.14 ARC-AGIp. 180
  160. 8.14.1 ARC-AGI-1 & ARC-AGI-2p. 180
  161. 8.14.2 ARC-AGI-3p. 182
  162. 8.15 Healthcarep. 184
  163. 8.15.1 HealthBench resultsp. 184
  164. 8.15.2 HealthBench Professional resultsp. 185
  165. 8.16 Multilingual performancep. 186
  166. 8.16.1 GMMLU resultsp. 186
  167. 8.16.2 MILU resultsp. 187
  168. 8.16.3 INCLUDE resultsp. 187
  169. 8.17 Life sciences capabilitiesp. 187
  170. 8.17.1 BioMysteryBenchp. 188
  171. 8.17.2 LatchBio Bioinformaticsp. 188
  172. 8.17.3 ProteinGym Hardp. 189
  173. 8.17.4 Protein Designp. 189
  174. 8.17.5 Organic chemistry, V2p. 189
  175. 8.17.6 Protocolsp. 189
  176. 9 Appendixp. 191
  177. 9.1 Blocklist used for Humanity’s Last Examp. 191
  178. 9.2 Blocklist used for BrowseCompp. 192
  179. 9.3 SWE-bench Multimodal Test Harnessp. 193