Harish Kumar 
Anthropic‘s newly published system card for Claude Opus 5 offers a rare, granular look at how a frontier AI model performs on offensive cybersecurity tasks, and the findings suggest the industry’s “capable but contained” narrative is holding, for now.
Anthropic is explicit that Opus 5 was never deliberately trained for cyber tasks; any gains in offensive capabilities appear to stem from broader model improvements rather than targeted red-team-style training.
Even so, the numbers show meaningful movement. On ExploitBench, a 41-target V8 (Chrome’s JavaScript engine) exploitation benchmark, Opus 5 generated 99 complete arbitrary-code-execution exploits, compared with just 2 for its predecessor, Opus 4.8, though it still trailed Anthropic’s more powerful internal model, Mythos 5, which produced 132.
Claude Opus 5 System Card
A similar pattern repeated on OSS-Fuzz, where Opus 5 scored a non-zero result on 79.4% of 830 open-source vulnerability targets (up from 38.5% for Opus 4.8), and on the Mozilla-collaborative Firefox 147 benchmark, where it built 131 full working exploits out of 250 trials, more than six times Opus 4.8’s tally.
The recurring theme across all benchmarks is a widening gap between identifying a flaw and weaponizing it. Anthropic notes that “Opus 5 is nearly as good as Mythos 5 at vulnerability finding, but not nearly as good at exploit development,” a distinction that matters because vulnerability discovery is dual-use, while functional exploitation is the step that actually enables an attack.
On UK AI Security Institute cyber-range testing, Opus 5 matched Mythos 5 on smaller network-attack simulations but made only limited headway against an industrial-control-system range, completing 3–5 flags where no model besides one internal preview build has ever fully succeeded.
The most consequential operational change isn’t a benchmark score; it’s a safeguards decision. Anthropic has now unblocked source-code vulnerability discovery for Opus 5 at all access levels, reasoning that this “core part of the secure software development lifecycle” primarily benefits defenders and coding teams shipping safer software.
Binary vulnerability finding, which skews toward offensive use since attackers typically lack source access, remains restricted. Anthropic is also expanding its Cyber Verification Program, granting bug bounty hunters and enterprise pentesters exemptions from standard blocks.
“What Anthropic has effectively published is a maturity curve for AI-assisted offense, not a single capability snapshot. The gap between ‘finding a bug’ and ‘weaponizing a bug’ is exactly where human tradecraft still adds irreplaceable value, and it’s the metric defenders should watch most closely as each model generation narrows it.”
On the agentic-safety side, Opus 5 posted its strongest results yet against prompt injection, a technique in which malicious instructions hidden in tool outputs hijack an AI agent’s actions.
Using Gray Swan’s adaptive Indirect Prompt Injection benchmark, attackers succeeded against Opus 5 only 2.0% of the time after 15 attempts, down from 5.5% for Opus 4.8, and notably better than competing frontier models, including GPT-5.6 variants, which scored as high as 43.9%.
External red teams from Trajectory Labs, 10a Labs, and Gray Swan also failed to find any new universal jailbreak against the model’s cyber safeguards.
For security teams, the takeaway isn’t alarm but calibration: AI models are becoming genuinely useful for defensive vulnerability triage while remaining a step behind at turning bugs into reliable exploits a gap researchers and CISOs should track as future releases continue to close it.
About the Author
Kiran 
