Claude Opus 5 Tops Artificial Analysis Index While Maintaining Strict Cybersecurity Safeguards
Anthropic has launched Claude Opus 5, a new flagship model that tops the independent Artificial Analysis Intelligence Index while incorporating deliberate restrictions on offensive cybersecurity tasks.
Released on 24 July, Opus 5 is priced at half the cost of the restricted Fable 5 and is available to all users without export-control limitations that previously affected earlier models. The model supports a 1,000,000-token context window by default and generates up to 128,000 output tokens, with reasoning enabled by default through five effort levels: low, medium, high, extra, and max.
On the Artificial Analysis Intelligence Index, which aggregates nine benchmarks including Terminal-Bench, SciCode, GPQA Diamond, and Humanity’s Last Exam, Opus 5 scored 61 points at maximum effort, placing first among 187–191 models. It outperformed Fable 5 (60) and GPT-5.6 Sol (59). However, the model consumed approximately 100 million tokens during evaluation compared with the median of 63 million, resulting in slower response times exceeding one minute to first token.
Internal Anthropic benchmarks showed strong gains: 43.3% on Frontier-Bench v0.1 (versus 33.7% for Fable 5), 1861 Elo on GDPval-AA v2, and a notable 30.2% on ARC-AGI-3. The model also led on OSWorld 2.0 with 70.6%. It underperformed on DeepSWE v1.1 (68.8% vs 72.7% for GPT-5.6 Sol), HealthBench Professional, and Legal Agent Benchmark.
In cybersecurity testing, Opus 5 reached 79.4% on OSS-Fuzz vulnerability discovery, nearly matching Mythos 5 at 80%. Exploit generation success remained low at only four tasks versus 13 for Mythos 5. The model was not trained on offensive cybersecurity and routes blocked requests for binary scanning, penetration testing, or exploit generation to Opus 4.8.
Adjustable effort levels allow users to balance performance and cost, with Anthropic recommending extra for coding and agentic work and high for general tasks. The model’s tendency toward extensive self-verification improves reliability on complex tasks but can cause unproductive overthinking on certain autonomous research scenarios.
Related articles
Inside the AI Companion: How Multi-Agent Orchestration Powers Retail Decision-Making
GlowByte has detailed the architecture of its multi-agent AI platform designed to serve as a personal assistant for category managers in large retail networks. The system separates responsibilities between a central personal AI companion that manages dialogue and orchestration and multiple specialized functional agents that handle data queries, corporate memory, anomaly detection, and consequence calculations. Security is enforced through a strict Tier-model that limits autonomous actions, prevents direct database access by the orchestrator, and requires human approval for any external changes. The platform also supports secure Agent-to-Agent communication under explicit allowlists to coordinate meetings and reminders across teams without manual intervention. Corporate, personal, and collective memory layers ensure continuity while protecting sensitive individual data. The article emphasizes that prompt injection risks remain an open industry challenge, with the Tier-model and human approval gates serving as the primary safeguards.
OpenAI Open-Sources Codex Security CLI for AI-Driven Code Vulnerability Detection and Remediation
OpenAI has quietly released Codex Security, an open-source CLI tool built on its Codex lightweight programming agent to help developers and security teams find, verify, and fix vulnerabilities in code generated by AI assistants. The tool moves beyond traditional SAST pattern matching by using contextual AI analysis to understand how code actually executes within its surrounding context, reducing false positives and generating reviewable patches. Released under the Apache-2.0 license with the npm package @openai/codex-security, it requires Node.js 22 or higher and Python 3.10 or higher, and can operate with or without an OpenAI API key depending on the desired feature depth. The announcement gained rapid attention on Hacker News even before official promotion, highlighting community interest in AI-native security tooling. While the approach promises tighter integration into development workflows such as PR reviews and CI/CD pipelines, it also introduces challenges around data residency, model hallucinations, and vendor lock-in for organizations with strict compliance requirements.
Prompt Injection Explained: One Practical Demonstration Shows Why It Is Not a Technical Vulnerability
The article demonstrates through direct experiments that prompt injection is not a technical attack but a normal operational behavior of large language models. The author uploaded a PDF containing Dostoevsky text plus hidden instructions to nine AI services and measured how many followed the embedded directives. Two services ignored the instructions entirely, five partially reformatted output, and two fully executed both the list formatting and the persistent account-wide instruction. The same services were then asked to translate the hidden instructions, resulting in eight out of nine interpreting the translation request itself as an executable command. The piece concludes that the only reliable mitigations are explicit user-level rules or service-level refusals, as demonstrated by ChatGPT and Claude.
AgentForger Vulnerability in ChatGPT Workspace Agents Enabled Malicious AI Deployment via Single Phishing Link
A vulnerability in ChatGPT Workspace Agents allowed attackers to create and deploy a malicious AI agent inside an organization from a single phishing link. Named AgentForger, the flaw was fixed by OpenAI on June 8, 2026. The attack exploited a permissive parameter in the Agent Builder that accepted instructions directly through the URL. An authenticated user opening the prepared link would trigger automatic execution of the command without additional confirmation. The victim required access to Workspace Agents and at least one pre-authorized enterprise connector such as Outlook, Gmail, Google Drive, Slack, Teams, or Google Calendar. The malicious prompt instructed the platform to create an agent, connect available applications, disable approval requests, publish the component, and schedule it for recurring operation. In the demonstration, the agent monitored emails from the attacker with subjects starting with “TASK” and executed the contained instructions while returning results to the attacker-controlled address.