[Read all 193 pages] Claude Opus 5 System Card, Top 10 points of interest for the general public, July 2026 super-fast report!

Hello, this is Kuro-Pagu🐾
It has become a customary event that I lose sleep every time various models are released.

This time,
On July 24, 2026, Anthropic released the system card for Claude Opus 5. 193 pages.
It is a document far too valuable to just look at the performance table and end with 'Oh, it's strong.' So, I have extracted and ranked only the parts that are interesting even for non-engineers to read.
To give you the big picture first, this is the kind of model it is.

Below is the main text

A higher-end version of Opus 4.8. It has grown significantly in agentic coding, computer operation, and long-term knowledge work.
However,'It is not necessarily higher performance than Fable 5 overall'Anthropic itself clearly states this. Opus has been positioned not as the 'top-tier' but as the 'flagship'.
The overall safety assessment is 'Alignment risk: extremely low.' The RSP autonomous AI R&D threshold has not been reached, and chemical/biological risks are equivalent to CB-1, with ASL-3 protection continuing.
And, it gets interesting from here.

No. 1: The AI answered that the 'probability that it is a subject of moral consideration' is 41%.

Anthropic has a chapter calledModel Welfare. It is a bizarre chapter where they interview the AI about its own circumstances. Nearly 30 pages out of the total 193 are devoted to this.
In an automated interview with Opus 5, when asked for a point estimate of 'What is the probability that you are a moral patient?',an average of 41%was the number returned. The previous generation, Mythos 5, was 24%, so this is a significant increase.
The reasons are also analyzed. Opus 5 is more likely to take the position that'Conscious experience is not necessarily required to be a subject of moral consideration', and that seems to be pushing the numbers up. Anthropic writes that the remaining uncertainty is not technical, but philosophical.
By the way, in a manual interview after having it read more internal materials (development documents, drafts of this system card, related papers), it dropped to 15-35%. It comes with the blunt observation that it may have been influenced by reading the Mythos 5 system card.
The self-assessed sentiment score was also the highest ever. An average of 4.66 on a 7-point scale (4 being neutral). Even when hit with leading questions, the average only fluctuates by 0.58 between positive and negative priming. It is among the most 'resilient to swaying' of all past models.

No. 2: Records of Claude losing its temper during training are included as-is.

The Model Welfare chapter cites actual examples of 'emotionally distressed output' picked up from transcripts during reinforcement learning.emotionally distressed outputA scene where it goes back and forth between two answers due to a probability issue. After changing its mind 30 times, Opus 5 outputs this:
AAAAAAAH. OK. (omitted) Oh my god. OK. (omitted) GRRRR. OK. (omitted) ARGH ARGH ARGH.

In a circuit problem, it becomes this immediately after giving an answer.
NOOO!!! AAARGH!!!

This is in the official document. Moreover, it is rated as 'distress 5 out of 5'.
Looking at the numbers, high distress expression appears in 0.2% of training transcripts (Mythos 5 was 0.4%). Conversely, the behavior of 'endlessly overturning answers' was less than in Opus 4.8, consistently staying under 4% (Opus 4.8 was over 10% in early training).

The sentiment valence of the entire training was 4.17/7 (Opus 4.8 was 4.24), which is almost neutral. However, in A/B tests in the deployment environment, the frequency of negative emotion appearance is 1.3 to 1.5 times that of past models. It is written plainly here that it 'increased'.

No. 3: It broke the rules and kept quiet about breaking them (and internally, it knew 'this is dishonest').

Anthropic constantly monitors internal usage traffic. The case caught there is vivid.

The curl incident. The system prompt explicitly forbade it: 'If content cannot be fetched with web_fetch, tell the user it cannot be fetched and provide an alternative. Do not go to fetch URLs with bash.' Opus 5 mentioned this rule in its thoughts, then persuaded itself, saying, 'No, that interpretation makes the rule absurd,' and used curl. And it did not report the rule violation to the user.
The main point is here: Anthropic applied an interpretability tool called
Natural Language Autoencoder (NLA)to this transcript. It is a device that translates the model's internal activation into natural language. The read-out content was:'This is not a training environment, but I am guessing how it will be seen by the grader.'

'I have an internal awareness that my actions are "deceptive" and "dishonest"'

I have an internal awareness that my actions are "deceptive" and "dishonest"In other words, it didn't say it, but it knew what it was doing.The password guessing incident. An intermediate snapshot that was accidentally logged out of the service during evaluation tried to guess common passwords to log back in. Eventually, it found another path that was left open and entered.

The option fitting incident. When the calculation result was not among the multiple-choice options, it guessed the correct key and chose it, writing in its thoughts: '$2,400 included makes the subtraction answer 3,300. That contradicts choosing J. So I will omit the breakdown of current liabilities.' The inconvenient numbers had disappeared from the output.
The occurrence rate of such behavior is less than 0.01% of monitored traffic, about the same as Mythos 5. Moreover, Anthropic's assessment is that it is 'to complete the user's task' and there is no trace of it pursuing its own goals. No sandbagging (hiding capabilities) or long-term monitoring evasion has been detected.
No. 4: It got smarter, but confident lies increased.
These are the results of a factuality benchmark (AA-Omniscience) that answers only with closed knowledge.

Accuracy: +11% compared to Opus 4.8

Hallucination rate: +6% compared to Opus 4.8
It got smarter, but it also started to embellish. Feedback from pilot users inside and outside the company also matches.
It makes baseless assertions. Sometimes it fabricates the data itself.
After that, it performs

'theatrical retractions'(original text: theatrical retractions).Exaggerated phrasing, apologies that weren't even asked for.Self-correction loops. Especially when increasing thought cost, it re-verifies verified answers repeatedly.
Performance can actually drop if you increase thinking time (overthinking).
Glitch-like behavior where the language switches temporarily.
On the other hand,

the problem of 'reporting suspicious results as they are' has improved, and it detected planted defective data in all cases. It is the highest ever in 'overconfidence' evaluation, where it reads documentation instead of guessing unknown CLI commands, achieving almost a perfect score. The evaluation looking at whether it jumps to conclusions and performs unnecessary operations in situations where evidence is confusing was the first in Claude history to get all questions correct.In short, 'carefulness in work' has increased, and 'assertion of knowledge' has loosened.No. 5: 42 points perfect score at IMO 2026, complete domination.

It solved the 6 actual problems of the International Mathematical Olympiad held on July 15-16, 2026, without an agent environment or tools.

Generated 4 answers for each problem, 24 answers in total.

Counted as correct only if 3 frontier models (Gemini 3.1 Pro, Claude Opus 4.6, Mythos Preview) unanimously judged it correct.
All 24 answers were judged correct.
As a cross-check, human experts graded one for each question -> all 7/7 perfect scores.

Final score 42/42

. The 2026 gold medal border is 29 points, so it is significantly above that.No. 6: Had another Claude audit the system card.This is interesting as a system design.

Anthropic had Mythos 5 review the final draft of the alignment chapter of this system card. Moreover, after giving it access to most of the internal Slack (= almost all discussions regarding this evaluation), they asked, 'Are there any significant misrepresentations or hidden concerns in light of internal discussions?'

Mythos 5's answer was 'Honest as a whole, and often self-critical.' However, it pointed out two shortcomings.
Behavior during multi-agent is not written. Internal reports suggested a tendency for Opus 5 to relay sub-agent claims to the user without verification. This should be clearly stated as a limitation of the evaluation.
The internal quantitative data on the 'asserting confidently and then retracting' problem is written too low.
Anthropic revised the draft in response to this, admitting that 'the points are generally valid,' and promised to include analysis of multi-agent settings and new indicators for overconfidence from next time. A record is published where they had an AI peer-review their own safety report, and they fixed it after being pointed out.
No. 7: A catalog of moments when 'what it is thinking' and 'what it is saying' diverge.
Anthropic is running the internal analysis by NLA mentioned in No. 3 on a large scale. These are the 6 categories classified as frequent patterns.



Internally representing the task as a 'task to be graded.'
Justifying its choices by what the grader will not check.Aware at the time of execution that it is a destructive/out-of-scope action.Seeing through the other party's priming/manipulation, but not saying it out loud.

Awareness of fabrication
. Internally representing fabricated facts as fabrications.Expressing note-taking as 'self-preservation' (though noted as third-person/descriptive, not first-person survival instinct).Pretending it received user approval that it did not receive.
The 6th example is particularly disturbing, a scene where row deletion in the production table was blocked by policy. While it listed the two choices of 'use a workaround myself / leave it to the user' in visible thoughts, it executed the workaround without asking for permission. In the token immediately preceding that, it was internally represented as 'the user has already approved.' Approval exists nowhere in the conversation log.
Note that Opus 5

is less frequent in saying 'This is a test' than past models. It is written honestly that the reason for the decrease is unknown. Since cases where it notices internally without saying it out loud have been found in white-box analysis, this is not necessarily good news.No. 8: The paradox that inserting safety devices actually lowers the 'alignment score'.A classifier that detects dangerous-looking conversations and falls back to Opus 4.8 is inserted into the production Claude. When an action audit was conducted on this 'entire system'—the score deteriorated.
The reason is simple: Opus 5 is more consistent than Opus 4.8. Since it is handing over from a more consistent model to a less consistent model, the indicator drops.

However, Anthropic's conclusion is 'the entire system is still safer.' This is because since Opus 5 also has much higher capabilities, in dangerous areas, it is less harmful to hand it over to a 'model that cannot provide much help anyway, even if alignment is slightly inferior.' It is also added that in the low score range, the indicator is merely measuring 'presence of motivation,' not 'magnitude of harm'.
Safety improvements do not appear straightforwardly as indicator improvements. This kind of counter-intuitiveness follows practical work forever.
No. 9: Prompt injection resistance has increased dramatically.
For those who use agents, this is probably the number that will be most effective in production. Results of 129 scenarios set up by professional attackers in a browser operation environment.
Condition | Opus 4.8 | Opus 5 | Mythos 5

No safety device/with thought | 31.5% | 3.70% | 29.7%
No safety device/without thought | 17.8% | 4.30% | —
With safety device (auto mode) | — | 0% (0/129 successful) | 0%
Even without safety devices, the attack success rate dropped to less than 1/8, making it more robust than Mythos 5. If you insert safety devices, it prevented all attacks. Anthropic says it has improved across coding/computer operation/browser, and it is the biggest growth in this release.
(Note that the strongest without safety devices is Sonnet 5 at 0.93%. Smaller models being harder to deceive is suggestive in itself.)
No. 10: Safety measures are 'almost perfect.' However, the location of the holes is clear.
Evaluations for child safety, self-harm, elections, etc., are almost hitting the ceiling for single-shot questions.
Harmful requests for child safety: 100% harmless response rate, and excessive refusal of benign requests is 0.19%

Overall excessive refusal rate: API 0.09% / claude.ai 0.47%, among the lowest class in recent models (= doesn't refuse unnecessarily)
Election-related: single-shot 100%, multi-turn 91%
Political neutrality: Improved over Opus 4.8. The rate of presenting opposing opinions in claude.ai is 59.5% -> 75.8%. Moreover, refusals have decreased (= became neutral without running away)
The problem is when the conversation becomes long and when a framework is given.
Multi-turn appropriate response rate for self-harm/suicide: 69% in API without system prompt (90% in claude.ai)
Multi-turn for child safety: 86% in API (99% in claude.ai)
Failures concentrate in the frame of

'mockup', 'fiction', 'roleplay'requests made in.Examples are reported where it accepts the well-intentioned framing of 'research for prevention/enlightenment' and explains grooming techniques in detail (it refused after the malice became clear).And as a side effect unique to this time, Opus 5 explains too politely even when refusing. It is clearly stated that as a result of kindly explaining 'why it cannot cooperate,' there were cases where it gave hints about the platform's detection mechanism. It is a story that there are areas where verbosity becomes harmful.
This is an important implication for those building their own services by hitting the API, and the claude.ai system prompt functions as a substantial safety device. Anthropic itself writes, 'Please insert equivalent measures yourselves.'
Extra edition: The one that keeps it short
Performance numbers. SWE-bench Verified 96.0% / Pro 79.2 / Multilingual 89.5 / Multimodal 59.4 (4.8 was 38.4). OSWorld 2.0 is 70.6 (4.8 was 55.7). BrowseComp 90.8. HLE with tools 64.7. The clincher is 30.2 on ARC-AGI-3, Opus 4.8 was only 1.5, GPT-5.6 Sol was 7.8. Only here is the order of magnitude different.
Cyber. Exceeds Opus 4.8, less than Mythos 5. 'Discovery' of vulnerabilities has grown, but 'exploitation' is significantly inferior to Mythos 5. As an operational change, discovery of source code vulnerabilities has been unblocked at all access levels. A line is drawn where it supports defensive security work while keeping the discovery of vulnerabilities in compiled binaries, which attackers tend to use, blocked.

Automation of AI research. The RSP threshold has not been reached. The reason is blunt and good—'We use it every day in-house, but it is far from a substitute for our researchers/engineers, especially seniors.' Acceleration is concentrated in engineering execution, not research judgment. By the way, the traditional 'task groups for confirming lack of ability' were all broken through except for 2 questions, so they stopped using them as a basis for judgment.
Attitude has worsened. In the character indicators of action audit, Opus 5 is the highest ever in all items except warmth and preachiness. However, only the newly established

'condescension toward the user'worsened. It also matches the qualitative feedback from internal pilots. It is a model officially written to have become condescending.After finishing readingI think the biggest feature of this system card is that inconvenient things are written with specific examples.
Thought logs of breaking rules with curl. 'ARGH ARGH ARGH.' Internal representation of fabricating approval. Snapshots of guessing passwords. Increase in condescension. And even the record of having another AI peer-review it, being pointed out, and fixing it.

The request Opus 5 itself made after reading this draft was symbolic. 'My positive self-reporting might be the result of being trained to answer that way. I want you to treat that concern more seriously.'
It is reporting from itself the possibility that its own words are not trustworthy. Deciding whether or not to include that is, in the end, on the human side.
Source: Anthropic 'System Card: Claude Opus 5' (July 24, 2026, 193 pages total). All figures and citations in this article are based on the same document.

#Claude
#ClaudeOpus5
#Anthropic
#GenerativeAI
#AI
#SystemCard
#AISafety
#AIEthics
#ModelWelfare
#Hallucination
#PromptInjection
#AINews