Anthropic released Claude Sonnet 5.5, marking the first time the company has integrated three-stage cyber safeguards and automatic model fallbacks into its middle-tier Sonnet line. While Anthropic states that Sonnet 5.5 does not advance the frontier of its overall model performance, its cybersecurity capabilities have increased significantly, prompting the deployment of classifier-driven safety routing previously reserved for higher-tier models. On the Terminal-Bench 4.0 agentic coding evaluation, Sonnet 5.5 reached a 70.6% score at its xhigh effort setting, outperforming Opus 5.5's 66.4%.
Significant Gains in Offensive Security
According to Anthropic's system card, Sonnet 5.5 demonstrated marked gains in offensive security tests when safeguards were disabled. The model recorded 178 full arbitrary code executions out of 410 runs on ExploitBench. On Irregular's CyScenarioBench, it completed 46.1% of tasks compared to 0.7% for Sonnet 5. Additionally, it achieved 50 control-flow hijacks on a binary exploitation test based on Google's OSS-Fuzz corpus, up from three on the prior generation.
These jumps led Anthropic to apply the same cyber policy used for Opus 5 and Opus 5.5. The enforcement process relies on internal activation probes, an on-model classifier running on Sonnet 5.5, and a separate LLM classifier that evaluates the output to decide if a request should be restricted. While Anthropic allows vulnerability discovery in raw source code, it blocks vulnerability scanning against compiled binaries.
Model Routing and API Integration
When the safety system flags a cyber-related request or specific machine learning kernel development queries, the system routes the request down to Sonnet 5. Requests involving chemical, biological, or conventional weapons, as well as anti-distillation triggers, are blocked completely without fallback. Anthropic's native applications automatically route blocked cyber queries to Sonnet 5, whereas API developers must explicitly opt into the fallback mechanism. Without enabling fallback, blocked API calls simply end.
Anthropic notes that safety checks evaluate all context ingested by the model, including retrieved documents, web search content, and connected files, meaning third-party data pulled by autonomous agents can trigger refusals or fallback routing even if unprompted by the user.
Prompt Injection Risks from Legacy Fallbacks
The fallback mechanism introduces security trade-offs for production environments. In Anthropic's internal coding tests, 25% of requests to Sonnet 5.5 triggered cyber safety blocks and were passed to Sonnet 5, frequently due to prompt injection attempts instructing the system to erase files or wipe disks. Of those rerouted queries, 12.01% successfully compromised Sonnet 5, whereas Sonnet 5.5 itself was compromised in only four out of 5,901 direct requests.
By contrast, a separate indirect prompt injection benchmark conducted by AI security firm Gray Swan showed no performance degradation when using fallbacks. Anthropic stated it is actively refining classifiers to lower false-positive refusals and plans to include Sonnet 5.5 in an expanded Cyber Verification Program to give vetted security professionals broader access.
AI-generated editorial illustration; not a documentary photograph.
Source: You picked Claude Sonnet 5.5 — but Anthropic may send your request to Sonnet 5
SIGNAL TITANS
Leave a Reply