---
title: Claude Opus 5.5 system card: in Gray Swan's adaptive coding prompt-injection test, every successful attack ran on the Opus 4.8 fallback model, not Opus 5.5 | ctxsec
url: https://ctxsec.com/items/anthropic-opus55-fallback-prompt-injection
description: ""
status: "confirmed (Anthropic system card + help center)"
published: 2026-10-17
---

> 

[← Context & Harness Attacks](/context) · [markdown](/items/anthropic-opus55-fallback-prompt-injection.md)

confirmed (Anthropic system card + help center)

2026-10-17

### Claude Opus 5.5 system card: in Gray Swan's adaptive coding prompt-injection test, every successful attack ran on the Opus 4.8 fallback model, not Opus 5.5

Claude Opus 5.5 (released Sep 22) falls back to Claude Opus 4.8 when its cyber classifiers flag a request as higher-risk offensive work (Anthropic lists exploit generation, binary-based vulnerability scanning and penetration testing). The fallback is automatic in Anthropic's own apps, including Claude Code; on the API, developers have to opt in. In section 5.2.2.1 of the system card, Gray Swan's Shade attacker ran 200 attempts on each of 40 coding scenarios. 64% of the requests that got a valid response were served by Opus 4.8, and those had an 85.73% attack success rate. None of the 2,872 requests Opus 5.5 answered itself were compromised. With prompt-injection probes on, the overall rate fell to 11.13%, and every success again came from fallback-served requests. In browser use, the only successful attack also ran on the fallback. On the static Gray Swan IPI benchmark, none of the 1,310 fallback-served rollouts were compromised, and Anthropic says it has strengthened Opus 4.8's injection safeguards since the Fable 5.1 card. Why this matters for agent harnesses: Anthropic's help center says the classifiers check everything the model reads (memory, connector content, web results, files), so 'a fallback can be triggered by content you didn't type'. After a switch, the conversation stays on the older model until you change it back. XDA Developers (Oct 17) drew attention to the numbers; the figures above come from Anthropic's own documents.

Sources: [Claude Opus 5.5 System Card (PDF), sections 5.2.1–5.2.2](https://www-cdn.anthropic.com/fc1b44717c85dc068bc6ba5024219938094694bd/Claude%20Opus%205.5%20System%20Card.pdf) · [Claude Help Center: why Claude switched models](https://support.claude.com/en/articles/16049681-why-claude-switched-models-in-your-conversation-with-opus-5-or-opus-5-5) · [XDA Developers (Oct 17)](https://www.xda-developers.com/claude-opus-5-5-model-switch-opus-4-8/)