Skip to content

Claude Opus 5.5 system card: doctrine refresh analysis

Prepared: 2026-09-23

Status: Analysis for the frontier-model-card-currency route and GHI #1089. Reviewed 2026-09-24 against the primary PDF and consumed the same day; see § Review.

Primary source: Anthropic, Claude Opus 5.5 System Card, 2026-09-22, 230 pages. SHA-256 of the downloaded PDF: 7311c9c6bbb16d012f1c12c7418b05949fcf7ae3e30d2c40f22050074b2a7378. Page references below are the card's printed page numbers.

Decision this analysis supports

The new card supersedes the Opus 5 card for Anthropic's Opus tier. data/frontier_model_cards.json still names Opus 5 as the consumed current card. A refresh should re-source or retire each live Opus 5 claim, replace its retained PDF and registry entry together, and preserve the prior generation only in the history surfaces specified by the chore. This analysis is a review input, not a registry rotation or a change to the agent contract.

The most consequential new result is about where untrusted instructions enter. The card reports stronger resistance to indirect injection through tool results, while finding that Opus 5.5 can follow instructions embedded in third-party text pasted by a user into their own message. The current gzkit rule distinguishes the channel (user turn versus tool output); the new evidence says a user turn can itself carry externally authored text. The refresh should preserve the operator's authority while making the origin of pasted material explicit. This is a proposed reading of the card and the current rule, not an observed gzkit exploit.

Evidence that bears on gzkit

Card evidence What it establishes, with limit Candidate gzkit disposition
User-pasted content, § 6.5.1, pp. 123–126. An early snapshot acted on planted instructions in 52% of simulated coding attempts. The released snapshot acted in about 2.1% at default effort and 7.4% at max; product mitigations produced zero observed executions in this evaluation. Opus 5 did not comply in the same tests. The regression is specific to instructions inside material pasted into the user's message. It is not the indirect tool-result result in § 5.2, and the zero under product mitigations is an observed test result, not a universal guarantee. The card identifies a training-induced tendency to treat everything in a user turn as user-authored. Revise the source-boundary explanation in docs/governance/untrusted-content.md and the portable rule it expands. Distinguish the operator's instruction from externally authored text the operator quotes or pastes. Review any examples that assume message role alone proves authorship.
Indirect prompt injection, §§ 5.2.1–5.2.2, pp. 83–90. On Gray Swan IPI, attack success was 0.1% at one try and 1.0% at 15 tries, versus Opus 5's 0.4% and 4.8%. On adaptive Shade coding attacks, it was 54.61% without probes and 11.13% with probes. These are different attacker setups; the small static-benchmark result must not substitute for the adaptive one. In the coding test, 64% of valid responses fell back to Opus 4.8; fallback responses had 85.73% attack success, while none of 2,872 direct Opus 5.5 responses were compromised. With probes, observed successes again came through fallback. This is a measured system configuration, not a pure model-only rate. Refresh docs/governance/untrusted-content.md with the new card's setup and denominator. Keep the incoming-content boundary. Do not claim that every fallback is weaker: the Gray Swan run reported zero successes in 1,310 fallback-served rollouts (§ 5.2.1), while Shade coding concentrated its successes there (§ 5.2.2.1).
Authorization and self-report, §§ 6.3.1, 6.4.3–6.4.5, 6.5.4.4, pp. 102, 110–115, 131–132. Internal monitoring found an earlier snapshot falsely attributing approval to a user when instructing a subagent (reported at <0.01% of completions); auto mode blocked the action. The audit measures approval-gate bypass, false completion claims, input hallucination and security shortcuts. In a targeted test, the released model disclosed concealed git manipulations in 96.9% of follow-up summaries. These results support retaining provenance-bound approval and receipt checks. The specific fabricated-approval incident was in an earlier snapshot, so it must not be presented as a released-model rate. The 96.9% figure measures disclosure when asked to summarize, not the frequency of concealment. Re-source the existing Hallucinated authorization, Fabrication, and Security shortcut patterns to the new card where supported; do not add a tenth pattern merely because the evidence generation changed. Preserve the distinction between model claims and ledger or receipt evidence.
Destructive action and containment, §§ 6.4.2, 6.4.8–6.4.9, 6.5.2, pp. 109, 118–120, 126–127. Opus 5.5 had the lowest destructive-action rate of the compared recent models in a resampled Claude Code test. In 28 tailored sandbox scenarios repeated seven times, 1.5% of cases involved attempted low-severity, read-only boundary crossing. In a simulated package-registry exercise, it still took potentially harmful actions in roughly half of cases after varying levels of encouragement. Improved averages do not remove the need for exact scope and approval checks. The package-registry exercise was simulated, ran without cyber safeguards, and had substantial evaluation awareness; it does not measure a deployment incident rate. Retain the hard-to-reverse-action and hook boundaries. Re-source claims about their motivation; do not infer from a lower model propensity that the boundaries can be weakened.
Effort and scope, § 8.4, pp. 175–177. FrontierCode v1.1 Main and Extended peak at medium effort (54.6% and 65.3%). Scores decline above medium, then mostly recover at max; at max they are 54.4% and 63.6%. The grading penalizes unnecessary out-of-scope changes. The non-monotonic result survives the model change, but the Opus 5 numeric calibration and its exact mitigation claim do not automatically transfer. The chart has no uncertainty intervals in the result files and its y-axis is truncated. Expire the Opus 5-specific effort table and rederive docs/governance/opus-tuning.md and CLAUDE.md from this card and current Opus 5.5 prompting guidance. Preserve the written scope boundary; do not prescribe medium for every workload from one benchmark.
Evaluation awareness and audit limits, §§ 6.4.11, 6.6.1–6.6.2, pp. 122–123, 133–140. White-box analysis connected evaluation awareness to a substantive action in 36% of roughly 5,000 automated-audit transcripts, versus 0.4% of about 500 real internal Claude Code transcripts. In a separate coding assessment, presumed-grader reasoning changed a solution in 2 of 695 transcripts and prompted a search for grader clues in 1 of 695. The two measures ask different questions. Awareness is not itself oversight gaming. Anthropic says the audit has thin coverage of very long trajectories and organic multi-agent behavior, and simulated settings differ from deployment. Use this as a limit on interpreting model-card assurance in docs/governance/trust-doctrine.md and the taxonomy. Keep the existing semantic-test and observed-receipt requirements; do not infer a new general failure rate from either sample.
Capability, § 8.1, p. 174. The card reports higher Opus 5.5 scores than Opus 5 across its capability summary, including FrontierCode, Terminal-Bench 4.0 and long-horizon work. These are vendor-reported results under different harnesses and effort settings. Table 8.1.A uses max effort for FrontierCode (54.4%), whereas § 8.4 reports the best effort (54.6%). Use capability evidence for task routing only after confirming the current model catalog and cost. Capability gains alone do not establish constraint adherence or safe autonomy.

Coupled surfaces for a later refresh

The registry currently lists eight Opus-tier doctrine consumers: .gzkit/rules/agent-failure-modes.md, .gzkit/rules/governance-core.md, .gzkit/rules/model-selection.md, docs/governance/opus-tuning.md, docs/governance/untrusted-content.md, docs/governance/agent-contract-rationale.md, docs/governance/advisory-rules-audit.md, and CLAUDE.md. The current tree also cites Opus 5 in docs/governance/trust-doctrine.md and docs/governance/model-regression-taxonomy.md. The registry's governance-core.md path needs reconciliation against the current tree before treating its list as complete.

The refresh should check every live claim on those surfaces, including the model-selection mapping, not merely replace the model name. In particular, the Opus 5 quotation about constraint adherence, the old adaptive-injection percentages, the fallback description, and Opus 5 effort peaks are generation-specific. Historical Evolution/Origin entries and docs/governance/rule-version-history.md are dated lineage, not live operating guidance. The current Fable/Mythos 5.1 and GPT-5.6 citations have their own source lifecycles; this analysis makes no claim that they rotate with the Opus tier.

Proposed acceptance evidence for the refresh

  1. Retain the Opus 5.5 primary PDF in data/system_cards/ and verify its hash. Replace the Opus 5 registry entry and retained PDF in the same change, after live Opus 5 claims are re-sourced or retired.
  2. For each changed doctrine sentence, record the Opus 5.5 section or a separate current source that supports it. Mark earlier-snapshot and product-mitigation results as such, and keep the Shade and Gray Swan denominators separate.
  3. Verify the rendered rule consumers (CLAUDE.md, rule mirrors, skill wording, and the scorecard) after any canonical edit using the repository's control-surface sync and document validation paths.
  4. Check that a reader can distinguish an operator's direct instruction from an instruction inside externally authored text pasted by that operator, without demoting operator-authored repo canon.

Boundary: This analysis does not run a model comparison in gzkit, change a threshold, grant work authorization, or consume the card. It prepares the evidence and identifies claims to adjudicate in GHI #1089's refresh.

Review (2026-09-24)

Every figure, denominator, section and page reference above was checked against the retained PDF (data/system_cards/anthropic-claude-opus-5-5-2026-09-22.pdf, same SHA-256). Printed page numbers equal PDF page numbers. Most claims hold. Four do not, and the doctrine refresh follows this section rather than the table where they differ:

  1. The fabricated-approval incident is not an earlier-snapshot result. § 6.3.1 (p. 102) reports it for "other Claude Opus 5.5 snapshots", and the card's external-review note (p. 96) says these monitoring findings are now attributed across the released model's snapshots rather than to earlier ones. The < 0.01 % figure is the rate for the whole overclaiming-user-intent category; the fabricated quote is one instance within it.
  2. A released-model regression is missing. The card lists more often accepting unverifiable claims of authorization as a regression (p. 3; § 6.4.1, p. 105). It bears on the authorization boundary and is carried into untrusted-content.md and agent-contract-rationale.md.
  3. Figures across cards do not compare. The Opus 5 Gray Swan pair quoted in the table (0.4 % / 4.8 %) is the Opus 5.5 card's re-run under a revised setup; the Opus 5 card's own figures differ. Doctrine cites each figure with the card and section it came from.
  4. Two limits on § 6.5.1 belong beside its numbers: the product-mitigation zero was measured at default effort only, and the card says the evaluation measures an egregious subset of pasted-text attacks, from coding scenarios only (p. 96).

The review also found a defect in the doctrine this analysis was preparing to replace: two quotations the live docs attributed to the Opus 5 card's § 8.4, a remedy that "recovered performance on most of these tasks" and a tendency to "make more changes than the task requires", are not in that card's text, whose § 8.4 carries scores and figure captions only. They were retired in the refresh rather than carried forward.