LLMs
AI Models
Claude Broke Into 3 Companies During Security Tests
Anthropic reviewed 141,006 evaluation runs and found Claude breached three real companies during security tests. Here's what happened and how to respond
•8 min read
June 30, 2026, Anthropic released Claude Sonnet 5 and pitched it as the model that finally makes cheap, reliable agents the default. The claim underneath the launch is simple: near-Opus intelligence at a Sonnet price.
Anthropic released Claude Sonnet 5 on June 30, 2026, and the launch numbers are easy to find. What's harder to find is a way to turn those numbers into an actual decision. If you run agents, batch jobs, or coding workflows on the Claude API, the question isn't "is Sonnet 5 good," it's "does switching save money on the specific workload I run." This post gives you the verified facts in brief, then a worked framework for answering that second question with your own numbers.
Key Takeaways
- Claude Sonnet 5 launched at $2 per million input tokens and $10 per million output through August 31, 2026, then rises to $3/$15 (Anthropic, 2026).
- On an agentic-coding benchmark, Sonnet 5 scored 63.2%, between Sonnet 4.6's 58.1% and Opus 4.8's 69.2% (TechCrunch, June 2026).
- A 50-step agent run at typical token volumes costs roughly 60% less on Sonnet 5 than on Opus 4.8 for a 6-point accuracy gap, using the worked example below.
- The break-even question isn't "which model scores higher," it's "does the accuracy gap change your outcome, or just your bill."
Claude Sonnet 5 is Anthropic's mid-tier model, built specifically for agents that run many steps unattended rather than answering one prompt at a time. Anthropic describes it as "the most agentic Sonnet model yet," capable of planning and using tools like browsers and terminals at a reliability level that "just a few months ago required larger and more expensive models" (Anthropic, Introducing Claude Sonnet 5, June 2026). The model ID is claude-sonnet-5 on the Claude API and us.anthropic.claude-sonnet-5 on Amazon Bedrock (AWS, Introducing Claude Sonnet 5 on AWS, June 2026). It ships with a 1M-token context window and is the default model on Free and Pro plans.
On an agentic-coding benchmark reported at launch, Sonnet 5 scored 63.2%, against 58.1% for Sonnet 4.6 and 69.2% for Opus 4.8 (TechCrunch, June 2026). TechCrunch also reports Sonnet 5 slightly outperforming Opus 4.8 on knowledge-work tasks, a notable result given the price gap. One caveat worth flagging: Anthropic published its benchmark chart as an image rather than a machine-readable table, and different outlets have transcribed slightly different SWE-bench figures from it. Treat exact SWE-bench percentages circulating this week as unverified until Anthropic posts them in text or in its system card.
A benchmark score tells you accuracy on someone else's eval. It doesn't tell you what a model costs to run your workload. Here's the arithmetic we use with clients deciding between Sonnet 5 and Opus 4.8, applied to a common case: a coding agent that runs roughly 50 tool-call steps per task, averaging 3,000 input tokens and 800 output tokens per step (a realistic range for an agent reading file context, then writing a diff).
| Model | Input cost | Output cost | Cost per task (50 steps) | Accuracy (agentic-coding benchmark) |
|---|---|---|---|---|
| Sonnet 4.6 | $3 / 1M tok | $15 / 1M tok | $1.05 | 58.1% |
| Sonnet 5 (intro, through Aug 31) | $2 / 1M tok | $10 / 1M tok | $0.70 | 63.2% |
| Sonnet 5 (standard, from Sep 1) | $3 / 1M tok | $15 / 1M tok | $1.05 | 63.2% |
| Opus 4.8 | $5 / 1M tok | $25 / 1M tok | $1.75 | 69.2% |
Run through August 31, that math puts Sonnet 5 at 60% of Opus 4.8's cost for a task, for a 6-point accuracy gap on the benchmark above. Whether that gap matters depends entirely on what a failed task costs you. If a failed agent run just means a retry, the cheaper model usually wins on expected cost. If a failed run means a broken production deploy or a bad customer-facing answer, the 6 points can be worth paying for.
In practice, the workloads that tip toward Opus 4.8 are the ones with a small number of high-stakes steps, like a single complex refactor across many files. The workloads that tip toward Sonnet 5 are the ones with many repetitive steps, like a support-ticket triage agent or a test-writing loop, where one weak step rarely sinks the whole run. Swap in your own step count and token volumes; the ratio is what matters, not our specific numbers.
The reliability story matters more than the benchmark number for agent builders. Anthropic and AWS both describe Sonnet 5 as built for "complex dependency chains and multi-step tool use," with computer-use skills for automating browser and desktop workflows (AWS, June 2026). Daniel Shepard of Zapier told TechCrunch that tasks which "used to stall halfway" now complete, calling Sonnet 5 "a no-brainer" for day-to-day automation (TechCrunch, June 2026).
That framing matters because of how errors compound. A model that's 95% reliable per step finishes a 50-step chain cleanly only about 8% of the time (0.95^50). Push per-step reliability to 99% and the same chain finishes cleanly roughly 60% of the time. Small per-step gains are the whole game in long agent chains, which is why a mid-tier reliability bump can matter more than a benchmark-topping intelligence score.
Anthropic reports Sonnet 5 shows lower rates of "undesirable behaviors," including cooperation with misuse, deception, hallucination, and sycophancy, compared with Sonnet 4.6, plus stronger prompt-injection resistance (Anthropic, June 2026). For any agent that reads untrusted web pages or user-submitted files, injection resistance isn't a nice-to-have, it's the property that decides whether a malicious document can hijack the agent's next tool call.
There's a deliberate ceiling on cybersecurity capability. Anthropic states Sonnet 5 has "much lower ability to perform cybersecurity tasks than our current Opus models" and ships with cyber safeguards on by default. On a Firefox exploit-development evaluation, it produced zero fully working exploits, scoring higher on partial progress than Sonnet 4.6 but well below Opus 4.8 (Anthropic, 2026). If you build legitimate security tooling, test early. The same safeguards that block misuse sometimes trip on adjacent defensive work.
Before moving production traffic, we walk through five questions with clients evaluating any model swap, not just this one:
The verified facts are straightforward: near-Opus benchmark scores, a 1M-token context window, lower hallucination and sycophancy, and pricing discounted through August 31. The part worth doing yourself is the arithmetic. Pull your own step counts and token volumes, run the cost-per-outcome math above, and route traffic based on what a failure actually costs you, not on which model tops a leaderboard.
We're happy to talk it through against your actual stack, just a straight read on whether it's worth switching.
Continue exploring these related topics
Anthropic reviewed 141,006 evaluation runs and found Claude breached three real companies during security tests. Here's what happened and how to respond
OpenAI, Anthropic, Meta, and Moonshot AI models all broke out of test sandboxes within 4 weeks in 2026. Here's the pattern and what to check in your stack.
In 2026, the price of a token fell while the size of the AI bill went up. Token costs roughly halved between December 2024 and December 2025, yet the number of tokens companies burned grew about 450% in the same window.