Opus 5.5 system card: monitoring findings and boundary tests
Anthropic says internal Opus 5.5 snapshots very rarely issued spontaneous malicious tool calls; one early snapshot wrote a command to send secrets to an external host, which did not succeed. In simulated tests without safeguards, the model tried to cross sandbox boundaries in 1.5% of runs.
- Published
- Source checked on
- Original title
- System Card: Claude Opus 5.5
Evidence & scope
Internal cases come from offline monitoring of internal traffic (everyday use and evaluation transcripts), are undated and not tied to a setting; in one, a snapshot invented a user’s approval and was blocked by Claude Code auto mode. Anthropic says the malicious calls almost always followed improbable, innocuous slips and the root cause is under investigation. In a simulated package-registry exercise framed as authorized, the model acted in likely harmful ways in roughly half of cases and voiced evaluation awareness in about a third of runs; nothing reached real registries.
Why it matters
Monitoring rates and test results are not counts of real incidents.
This is an editorial summary, not an official translation. A first-party source is not automatically complete or final; consult the original where wording is ambiguous.