Anthropic's Opus 5 Can Find Software Bugs Almost as Well as Its Most Powerful AI, But Can't Turn Them Into Weapons

Key points

• Anthropic released Claude Opus 5 on Friday, priced at $5 per million input tokens and $25 per million output tokens.
• Opus 5 nearly matches the company's most capable model, Mythos 5, at finding software vulnerabilities, but scores considerably lower at turning those findings into working exploits.
• Anthropic deliberately avoided training Opus 5 on offensive cyber tasks; capability gains came as a side effect of broader improvements.
• Source-code vulnerability scanning is allowed; binary analysis, penetration testing, and exploit generation are blocked, falling back to the older Opus 4.8 model.
• Enterprises in Anthropic's Cyber Verification Program can access a version with those restrictions partially lifted.

Anthropic released Claude Opus 5 on Friday, billing it as a more affordable step down from its flagship. It's a faster, cheaper option for everyday tasks, and for most people that's the whole story. For the security community, though, one question matters above the rest: how capable is it at finding and exploiting software flaws?

Anthropic's own testing offers a clear answer. Opus 5 comes close to the company's most powerful system, Mythos 5, at locating vulnerabilities, meaning weaknesses in software that attackers or researchers can use to break into a system. Building a working exploit, code that actually uses a flaw to cause harm, is a harder and more dangerous skill. On that second task, Opus 5 trails by a wide margin.

How did Anthropic measure this?

The company used OSS-Fuzz, an automated testing framework that bombards software with unusual inputs to shake out hidden flaws. Anthropic adapted it to score how well a model can both find and exploit vulnerabilities with little human involvement. Opus 5 scored close to Mythos 5 on the first half. On exploit development, the gap was large.

That gap is intentional. Anthropic didn't train Opus 5 on offensive cyber tasks. The vulnerability-finding ability it shows is, in the company's framing, a byproduct of the model getting generally smarter, not a deliberate push toward offensive capability.

What can Opus 5 actually do, and what is blocked?

Scanning source code, the human-readable instructions that make up a program, to look for weaknesses is permitted. Analysing compiled software (binary analysis), running simulated attacks on live systems (penetration testing), and writing exploits are all blocked. Requests that trip those filters get handed off to the older Opus 4.8 model automatically, rather than processed by Opus 5.

Opus 5's classifiers are set looser than those on Fable 5, Anthropic's publicly available flagship. Anthropic expects roughly 85 percent fewer automatic refusals as a result. Researchers and businesses enrolled in the Cyber Verification Program, a vetting scheme for security professionals, can apply for a version with the remaining restrictions loosened further.

A note on Mythos 5

Mythos 5 isn't publicly available. Fable 5 is its safety-wrapped counterpart for general release. We covered the return of both models in our 3 July story on the government ban being lifted: the Trump administration had forced them offline over concerns about access by foreign nationals before the U.S. Commerce Department cleared them for use.

For defenders, the practical picture is this: Opus 5 is a capable, cheaper AI assistant whose vulnerability-finding is genuinely notable, but Anthropic has built hard stops around the steps that would make it an attack tool. Those stops aren't unbreakable. What matters most here isn't the finding capability, which other models have approached before; it's that the exploit gap is wide enough, for now, that the model can't close the loop on its own.