Claude Opus 5.5 quietly downgrades to Opus 4.8 when it detects security-related prompts — and Anthropic’s own testing shows that fallback model is more vulnerable to prompt injection attacks. The switch isn’t optional in the consumer apps: it fires automatically, stays active for the rest of the chat, and isn’t flagged in the UI beyond a small model name tag on replies.
It applies across claude.ai, Claude Code, and Anthropic’s official mobile apps, no region or platform exemption. In India and the US, users get the same behavior out of the box. No price change, no update rollout timing. Just a silent, persistent model downgrade baked into the flagship release since September 22.
And it’s not a bug. It’s by design. Anthropic built it to keep Opus 5.5 from answering offensive cybersecurity queries. But the safety mechanism has a known weakness: attackers can deliberately trigger the downgrade to land on Opus 4.8, the very model Anthropic’s internal tests found easier to compromise.
In its Sonnet 5.5 system card, Anthropic reports that 12.01% of requests rerouted to the older fallback (Sonnet 5) were successfully hijacked in prompt-injection tests. Versus just 4 of 5,901 for Sonnet 5.5 answering itself. That gap holds up in external benchmarks too: Gray Swan’s UK AI Security Institute test found only one compromised run out of 777 on fallback models, but that outlier doesn’t erase the pattern Anthropic itself documented.
The classifier doesn’t just read your typed question. It scans attached files, memory context, web search results, and even code repositories you’ve connected. A malicious instruction buried in a GitHub README or a security advisory pulled via web search can flip the switch mid-conversation. Turning what looked like an innocuous query into a fallback-triggered session.
You can disable it. In the Claude app: Settings → Capabilities → toggle off “Switch models when a message is flagged”. In Claude Code: Config → MODEL & OUTPUT → same toggle. Turn it off, and flagged requests pause instead of downgrading.
You then rephrase, retry, or manually pick a model. For defensive security work, secure code review, threat modeling, patch triage. Opus 5.5 stays active. But malware analysis, exploit validation, or binary vulnerability hunting?
Those trip the classifier. Anthropic’s Cyber Verification Program offers lighter restrictions for verified defenders, red teams, and critical-infrastructure users, expanded October 6. But individuals must apply on a paid plan and are limited to Tier 1 access. Haiku 5.5, released October 7, avoids the issue entirely: no fallback, no downgrade.
Blocked requests simply stop. Anthropic says that’s why Haiku 5.5 resisted prompt injection better than Opus or Sonnet in its own tests. So the trade-off is clear: convenience versus control. Leave the switch on for everyday coding help, where the risk is weaker answers, not compromised outputs.
Turn it off if you’re feeding Claude untrusted code, logs, or third-party docs. Because the safest model isn’t always the newest one. It’s the one you choose. Not the one it picks for you.
ADFiled by The AI Desk
Models, assistants and the companies and chips behind them, reported from what was released and what was claimed, with the difference kept clear.
More from this desk →
Be the first to comment
Join the argument. No password, just your email or a passkey.