Claude Opus 5.5 quietly switches to Opus 4.8 for security
Claude can move flagged security requests from Opus 5.5 to the older Opus 4.8, creating a fallback risk Anthropic’s own tests expose.
Claude Opus 5.5 is designed to stop higher-risk cybersecurity requests from being answered by its flagship model. The surprising part is what happens next: Anthropic can quietly move the conversation to the older Opus 4.8 instead, where the safety trade-off becomes harder to assess. 1
The hand-off is triggered by Anthropic’s cyber-safety classifiers. The company says they examine a request and, when necessary, route it away from Opus 5.5. In Claude’s apps, including claude.ai and Claude Code, the older model then answers and remains selected for the rest of that conversation. Anthropic’s own launch material says cybersecurity tasks that trigger its safeguards were completed by Claude Opus 4.8. 1
Why Claude switches models
The system is meant to prevent Claude Opus 5.5 from assisting with offensive cyber activity while preserving access to lower-risk defensive work. Anthropic draws a line between tasks such as reviewing secure code, threat modelling, patching known issues and triaging alerts, and work such as malware analysis or exploit validation. 1
The classifiers do not only inspect the words typed by the user. Anthropic says the system can also consider material Claude reads through memory, attached files, connectors and web searches. That means a hostile instruction hidden in a repository or a web result could help trigger the switch even when the user’s question looks harmless on its own. 2
The app gives users a way to stop that automatic fallback. The setting is called “Switch models when a message is flagged”. Turning it off means a flagged request pauses instead of being handed to Opus 4.8, allowing the user to rephrase it, retry it or choose a model manually. 2
The fallback is the awkward bit
The safeguard creates an uncomfortable security loop. Anthropic’s testing of the related Sonnet 5.5 fallback found that 12.01% of the fallback model’s runs were compromised in one adaptive attack test, compared with four of 5,901 requests for Sonnet 5.5 itself. The company says the test involved attempts to make an agent perform destructive actions such as wiping a disk. 2
Those figures are not a direct measurement of Opus 4.8. They come from Sonnet 5.5’s system card, where Sonnet 5 acts as the fallback, so they should not be presented as an Opus result. They do show why the design deserves scrutiny: a request is blocked on the stronger model, then moved to a model that may be easier to manipulate.
Anthropic also reports a more reassuring external result. In a separate benchmark built with the UK’s AI Security Institute, one of 777 fallback-served runs was compromised, and Anthropic says the fallback did not reduce robustness there. The available evidence therefore points to a real but uneven risk, rather than proof that every fallback is unsafe. 2
Our opinion
The model switch is better than silently allowing a powerful system to handle a request it has identified as dangerous. But the fallback should be treated as a security boundary, not as an invisible implementation detail. If Claude is working across repositories, inboxes or web pages that the user did not write, stopping the request is easier to understand and audit than quietly changing the model behind it.
Anthropic’s toggle is therefore worth finding before using Claude for security-sensitive agent work. Users who leave it enabled get a useful safety brake, but they should know that the brake may redirect the conversation rather than stop it. The company’s own tests do not make that trade-off simple, and the model name shown in the interface or API response matters.