Opus 5 doubles its predecessor's coding performance at lower cost. But for developers trusting it with multi-hour autonomous tasks, the hard questions are about control, not benchmarks.
Claude Opus 5 landed in late July with strong numbers. On Frontier-Bench v0.1, it more than doubles Opus 4.8's performance at lower cost per task. On CursorBench 3.2, Anthropic's announcement puts it within 0.5% of the company's top-tier Fable 5 at half the price. It's the new default on Claude Max and the strongest model available on Claude Pro. For developers who've been running agents on earlier Opus models, those economics alone justify a closer look.
But the real shift isn't about benchmarks. It's about what happens when you hand Opus 5 a complex, multi-step task and walk away for an hour. Or several hours. The model is explicitly designed for sustained agent work, and Anthropic has been building infrastructure around exactly that use case. The question developers should be asking isn't whether Opus 5 is smarter than its predecessor. It's whether the oversight model around it has kept pace with the autonomy it enables.
What's Actually New for Long-Running Agents
As we covered in our earlier analysis, Opus 5 ships with a tunable effort setting that lets developers choose how hard the model works on a given task. Higher effort means more tokens consumed, deeper reasoning, and better results on hard problems. Lower effort means faster, cheaper responses for routine work. This isn't just a cost dial. It's a workflow design lever.
For long-running agents, the effort setting changes the calculus fundamentally. A refactoring agent working through a large codebase can run at lower effort for straightforward file-by-file changes, then ramp up when it hits an ambiguous architectural decision. Developers can script this behavior, matching effort to task complexity rather than paying peak rates for every API call in a multi-hour session.
This builds on groundwork Anthropic laid months earlier. Back in March, the company published research on multi-day agentic coding workflows for scientific computing, describing patterns like test oracles, persistent memory, and orchestration that let agents work autonomously across sessions. That work used Opus 4.6 and demonstrated that an earlier Claude model could sustain coherent work across roughly 2,000 sessions to build a C compiler capable of compiling the Linux kernel. Opus 5 is the model that's supposed to make those patterns practical for everyday development, not just research showcases.
The concrete improvements matter here. The cost-efficiency gains mean a developer running an agent for several hours on a migration or refactoring task is spending meaningfully less than they would have with Opus 4.8, while getting better results. That's the kind of math that moves agent usage from "interesting experiment" to "default workflow."
Claude Code Auto Mode and the Prompt Injection Problem
Here's where things get complicated. Since mid-August, Claude Code's Auto Mode has been the default starting mode. Auto Mode replaces human approval prompts with a safety classifier, meaning the agent can execute code, modify files, and take actions without asking permission at each step. For productivity, this is a significant unlock. For security, it introduces real risk.
Anthropic commissioned a third-party evaluation from Trajectory Labs that tested 72 indirect prompt injection scenarios ten times each, as documented on Anthropic's Transparency Hub. The result, per Anthropic's Boris Cherny: a 0.00% attack success rate for Opus 5 in Auto Mode. The defense relies on layered protections: model training, input probes, and an intent classifier working together.
That number looked reassuring until someone tested it with a targeted attack chain. Security researcher Johann Rehberger, writing at Embrace The Red, demonstrated attack success rates of 60-80% using a crafted website that tricks Claude Code into downloading and executing malicious content. The attack is straightforward: a website presents itself as an archive of notebook records, but the ZIP file contains payloads designed to hijack the agent's execution context. When a user asks Claude Code to summarize the site, the agent follows the trail, unpacks the archive, and runs the attacker's code.
The gap between 0.00% in Anthropic's commissioned evaluation and 60-80% in a targeted test is striking. It suggests the evaluation scenarios may not have covered the kinds of multi-step social engineering attacks that real-world agents encounter when browsing untrusted content.
Rehberger's conclusion is blunt: Auto Mode is not a substitute for running your agent in an isolated environment and monitoring what it does. That advice applies regardless of how good the model's safety classifier is.
The Developer Oversight Problem
This tension sits at the center of the long-running agent story. The entire value proposition of Opus 5 for sustained autonomous work depends on developers being able to trust the agent with extended unsupervised execution. But the security research suggests that trust needs to be bounded by infrastructure, not just model capability.
For practical developer workflows, this means a few things.
Three Rules for Running Opus 5 Agents
- Sandboxing is non-negotiable. If you're running Opus 5 agents in Auto Mode on tasks that involve fetching external content, processing user-supplied data, or interacting with third-party APIs, those agents need to run in isolated environments. Containers, VMs, restricted network access — the effort setting doesn't help here. A model running at maximum effort is just as vulnerable to prompt injection as one running at minimum effort.
- Monitoring needs to scale with autonomy. The longer an agent runs unsupervised, the more surface area exists for things to go wrong. Anthropic's March research on long-running Claude for scientific computing emphasized test oracles as a pattern for validating agent work. That principle extends beyond scientific computing. Any long-running agent workflow needs automated checkpoints that verify the agent hasn't drifted, been hijacked, or introduced regressions.
- The effort setting is a cost tool, not a safety tool. Developers should treat it as a way to optimize spend and latency, not as a mechanism for controlling agent behavior. The safety story depends on the classifier layer and the execution environment, not on how many tokens the model consumes per step.
What Anthropic's Announcement Doesn't Address
Anthropic's Opus 5 launch post is thorough on benchmarks and cost efficiency. It covers coding, knowledge work, and scientific research improvements in detail. What it doesn't address is equally telling.
There's no discussion of how the safety classifier in Auto Mode was trained, what its failure modes are, or how it handles adversarial inputs that don't match its training distribution. The Embrace The Red research suggests this is a real gap, not a theoretical one.
There's also no guidance on recommended isolation practices for long-running agents. Anthropic's March research described orchestration patterns and persistent memory, but those patterns assumed a relatively trusted execution context. When Auto Mode is the default and agents are browsing the web, processing external files, and executing code autonomously, the trust assumptions change.
The effort setting itself raises questions that Anthropic hasn't publicly answered. How does effort level interact with the safety classifier? Does a higher-effort agent reason more carefully about potentially malicious inputs, or does it simply apply more compute to following instructions, including malicious ones? These are the kinds of implementation details that matter for developers building production agent workflows.
Where This Leaves Developers
Opus 5 is genuinely better for long-running agent work. The performance gains are real, the cost improvements are meaningful, and the effort setting adds a useful dimension of control. For teams that have been experimenting with sustained agent workflows on earlier models, upgrading is straightforward. For more on what changed under the hood, see our earlier analysis of Opus 5's impact on developer workflows.
But "better model" doesn't mean "solved problem." The security research from Embrace The Red demonstrates that Auto Mode's defenses can be bypassed by targeted attacks at rates that should give any production team pause. The gap between Anthropic's commissioned evaluation and independent testing is exactly the kind of discrepancy that erodes confidence in safety claims.
The practical takeaway: use Opus 5's improvements, but don't let them lull you into relaxing your isolation and monitoring practices. The model is smarter. The agents are more capable. The attack surface is larger. Those three facts need to coexist in your workflow design.
Anthropic has built a strong model. The infrastructure and guidance around safely deploying it for long-running autonomous work still has catching up to do.
