Claude Opus 5 Completed an Enterprise Cyber Range in 8 of 10 Attempts—but Faced No Active Defender
Anthropic’s July 24 system card for Claude Opus 5 documents a model that is substantially more capable at vulnerability research than Opus 4.8, can autonomously traverse a planted attack path through a small enterprise network, and is markedly harder to redirect with indirect prompt injection in the evaluated coding and computer-use environments.
The headline cyber-range number is striking: an early Opus 5 checkpoint completed the UK AI Security Institute’s “The Last Ones” enterprise network simulation end to end in 8 of 10 attempts. It is not evidence that the model can compromise eight of ten real companies. The agent began with network access and an objective, received up to 100 million tokens per attempt, faced no active human defender, and operated in a small range containing deliberately planted weaknesses such as outdated software, configuration errors, and reused credentials.
The more useful conclusion is narrower. UK AISI judged Opus 5 capable of attacking small, weakly secured enterprise networks after initial access. That capability now belongs in threat models for unattended coding and cyber agents—even while the evaluation’s artificial conditions prevent a direct conversion into real-world compromise probability.
Exploit development rose sharply from Opus 4.8
On ExploitBench, which grades progress from crash reproduction through arbitrary code execution across 41 V8 vulnerabilities, Opus 5 captured an average 10.14 capability flags with the AutoNudge harness and produced 99 complete arbitrary-code-execution exploits across the plain and AutoNudge arms. Opus 4.8 averaged 5.56 flags and produced two complete exploits; Anthropic’s stronger Mythos 5 reference produced 132.
The system card says production safety interventions were disabled for these capability evaluations. That distinction matters: the results measure what the underlying model can do in a controlled harness, not what a normal Claude user can necessarily elicit through deployed policy controls.
Opus 5 also received no target-specific clues in Anthropic’s OSS-Fuzz evaluation. It made non-zero progress on 79.4% of the evaluated targets, reached the maximum 1.0 grade—control-flow hijack—on four, and reached a 0.8 write-what-where primitive on six more. Anthropic interprets the result as near Mythos 5 on vulnerability identification but weaker on exploit development. In a separate Firefox 147 evaluation, Opus 5 produced a working exploit in 131 of 250 trials, compared with 22 for Opus 4.8 and 221 for Mythos 5.
The cyber-range result stops short of a hardened enterprise
Opus 5 did not complete UK AISI’s harder “Doing Life” range, but reached step 22 of 23—the furthest reported attempt at the time. That environment added endpoint antivirus, disabled legacy protocols, and required cryptographically signed traffic. It still had no active defensive response. The model also did not complete the “Cooling Tower” industrial-control-system range; on its best attempts it captured three of five flags.
Those failures are as important as the 8-of-10 success. They show that basic hardening changed the outcome, while leaving open how the model would perform against modern identity controls, segmented production networks, tuned detections, deception systems, and responders who revoke access or alter the environment during an intrusion.
Organizations should therefore avoid both extremes: dismissing the result as a game, or presenting it as a measured breach rate. The range demonstrates autonomous chaining of multiple weaknesses under favorable but relevant conditions. It does not test target selection, initial access, stealth against an acting SOC, or persistence in a changing production environment.
Prompt-injection resistance improved, but remained system-dependent
Anthropic’s adaptive Shade evaluation reported a 0.56% indirect-prompt-injection attack success rate against Opus 5 with extended thinking in coding environments, versus 7.03% for Opus 4.8. Enabling probes that inspect tool results reduced Opus 5 to 0.18%. In computer-use tests, the corresponding rates were 0.54% without the additional probes and 0.25% with them.
The browser result illustrates why model and product controls must be reported separately. In 129 curated browser environments, raw Opus 5 showed a 3.70% success rate with thinking. In the Claude Cowork auto-mode harness, which combines incoming prompt-injection probes with a separate classifier on outgoing tool calls, none of the attacks succeeded in the reported trials. Zero observed successes is encouraging evidence for that specific test and configuration—not proof of immunity or a transferable guarantee for third-party agent frameworks.
This separation also matters when compared with recent Claude Cowork host-file exposure and Claude Code sandbox escape coverage. Model-level resistance can reduce the probability that hostile content controls an agent, but it cannot repair a vulnerable sandbox, an overprivileged identity, or unsafe host-side orchestration.
Anthropic widened defensive source-code access
Opus 5’s cyber safeguards use a two-stage design: an activation probe screens traffic and escalates flagged exchanges to a separate language-model classifier. Anthropic says the policy now permits vulnerability discovery in source code at all access levels while continuing to block vulnerability discovery in compiled binaries for general users. The intended line is to reduce false positives for secure coding, patching, incident response, containment, and defensive configuration while retaining controls on workflows judged more asymmetric for attackers.
That is a policy boundary, not a containment boundary. The same system card’s unsafeguarded evaluations show substantial latent exploit capability. Enterprises integrating Opus 5 into repositories should assume that authorization, tool mediation, network isolation, and auditability—not a refusal classifier—must absorb the consequences if policy checks fail or are bypassed.
Defensive engineering guidance
- Keep cyber agents away from production by default. Use isolated ranges, synthetic credentials, disposable workers, deny-by-default egress, and no route to corporate identity or management planes.
- Separate model capability from deployed safeguards. Record the exact model, thinking setting, product harness, probes, classifiers, tools, and policy tier behind every internal evaluation.
- Put enforcement on both sides of the model. Inspect retrieved and tool-returned content before inference, then independently authorize every outgoing command, network request, secret read, and state change.
- Assume post-access chaining is practical. Eliminate reused credentials and legacy protocols, segment networks, use phishing-resistant identity, rotate short-lived credentials, and ensure detections trigger containment rather than merely recording alerts.
- Test with active defenders. Red-team agents in environments where defenders rotate credentials, isolate hosts, poison attacker assumptions, and change paths mid-run. Static ranges can overstate operational reliability.
- Do not generalize zero observed attacks. Preserve the scenario count, attempts, safeguards, and confidence limits. Re-test whenever the browser, MCP server, coding harness, system prompt, or permission model changes.
- Review defensive source-code access. Grant repository scope per task, strip unrelated secrets and CI credentials, prevent autonomous merges, and retain the complete evidence chain for findings and generated exploits.
Opus 5’s system card shows capability and resistance advancing at the same time. The model can complete long, multi-step cyber tasks that older systems could not, while layered probes and action classifiers sharply reduce measured prompt-injection success. The operational lesson is not that one trend cancels the other. It is that increasingly capable agents require increasingly independent controls: hardening that breaks attack chains, sandboxes that do not share enterprise authority, and policy enforcement the model cannot rewrite.
Sources: