Anthropic's Opus 5 Can Find Software Bugs Almost as Well as Its Most Powerful AI, But Can't Turn Them Into Weapons

Key points

• Anthropic released Claude Opus 5 on Friday, priced at $5 per million input tokens and $25 per million output tokens.
• Opus 5 nearly matches the company's most capable model, Mythos 5, at finding software vulnerabilities, but scores considerably lower at turning those findings into working exploits.
• Anthropic deliberately avoided training Opus 5 on offensive cyber tasks; capability gains came as a side effect of broader improvements.
• Source-code vulnerability scanning is allowed; binary analysis, penetration testing, and exploit generation are blocked and fall back to the older Opus 4.8 model.
• Enterprises in Anthropic's Cyber Verification Program can access a version with those restrictions partially lifted.

Anthropica released Claude Opus 5 on Friday, billing it as a more affordable step down from its flagship offerings. For most people, the new model is a faster, cheaper option for everyday AI tasks. For the security community, it raises a specific question: how capable is it at finding and exploiting software flaws?

The short answer, according to Anthropic's own testing, is that Opus 5 is nearly as good as the company's most powerful system, Mythos 5, at locating vulnerabilities. A vulnerability, in plain terms, is a weakness in software that criminals or researchers can use to break into a system. Finding them is one skill. Building a working exploit, meaning code that actually takes advantage of the flaw to cause damage, is a harder and more dangerous one. On that second task, Opus 5 trails Mythos 5 by a wide margin.

How did Anthropic measure this?

Anthropica used a testing framework called OSS-Fuzz, an automated system that bombards software with unusual inputs to shake out hidden flaws. The company adapted it to score how well a model can both find and exploit vulnerabilities with little human help. Opus 5 scored close to Mythos 5 on the first half of that test. On exploit development, the gap was significant.

Anthropica says this is intentional. The company did not train Opus 5 directly on offensive cyber tasks. The vulnerability-finding ability it shows is, in Anthropic's framing, a byproduct of the model getting generally smarter, not a deliberate push toward offensive capability.

What can Opus 5 actually do, and what is blocked?

Opus 5 can scan source code, the human-readable instructions that make up a program, to look for weaknesses. That is permitted. What is blocked: analysing compiled software (binary analysis), penetration testing (simulated attacks on live systems), and writing exploits. If a user tries any of those, the system automatically hands the request back to the older Opus 4.8 model instead of Opus 5.

The safety filters on Opus 5 are deliberately less restrictive than those on Fable 5, Anthropic's publicly available flagship. The company expects about 85 percent fewer automatic interventions, meaning the model will refuse fewer requests overall.

Researchers and businesses enrolled in Anthropic's Cyber Verification Program, a vetting scheme for security professionals, can apply for a version with the remaining restrictions loosened further.

A note on Mythos 5

Mythos 5 itself is not publicly available. Fable 5 is described as its safety-wrapped counterpart for general release. Both models were briefly taken offline last month following concerns from the Trump administration about access by foreign nationals; the restrictions were later lifted, as first reported by SecurityWeek.

For ordinary users, the practical takeaway is straightforward. Opus 5 is a capable, cheaper AI assistant. Its ability to spot software flaws is notable, but Anthropic has built hard stops around the steps that would make it a genuine attack tool. Those stops are not unbreakable, but their existence reflects a deliberate choice about what the company is willing to release.