On the API the response's model field shows when Opus 4.8 answered instead of Opus 5.5. Log it and alert on it for agents that read email, web pages, tickets or repos. Decide on purpose whether to opt in to automatic fallback for those agents, rather than turning it on by default. In Claude Code and claude.ai, the model picker stays on Opus 4.8 after a switch, so start a fresh session (or switch back and edit the triggering message) before you hand the agent untrusted input again. Keep your own guardrails, such as tool allowlists, human approval for destructive actions and network egress limits, regardless of which model is serving. Security teams doing legitimate malware or exploit work can apply to Anthropic's Cyber Verification Program for reduced blocking.