Anthropic has launched Claude Sonnet 5, its most capable mid-tier model yet, pulling performance close to its flagship Opus 4.8 on reasoning, tool use, and coding while costing significantly less. The release marks a shift in how frontier AI labs are positioning their model lineups, with Anthropic deliberately shipping a broadly available agentic model that cannot perform offensive cybersecurity work, treating that absence as a safety feature rather than a limitation.

What Makes Claude Sonnet 5 Different From Previous Versions?

Claude Sonnet 5 represents a meaningful step forward in agentic capabilities, the ability for AI models to plan, operate tools, and run autonomously toward complex goals. On benchmarks measuring real-world agentic work, Sonnet 5 improves cleanly over its predecessor Sonnet 4.6. On BrowseComp, a benchmark for agentic search, and OSWorld-Verified, which tests computer-use skills, the new model demonstrates capabilities that previously required larger, more expensive models like Opus 4.8.

Early access testers reported that Sonnet 5 finishes complex tasks where older Sonnet models stopped short and checks its own output without being asked. The model shows lower rates of misaligned behavior, hallucination, and sycophancy compared to Sonnet 4.6, and is better at refusing malicious requests and resisting prompt-injection attacks, though it scores worse on these safety measures than the flagship Opus 4.8 and Mythos Preview models.

Pricing and availability are aggressive. Sonnet 5 is now the default for Free and Pro plans and is available across Max, Team, Enterprise, Claude Code, and the Claude Platform. Introductory API pricing runs $2 per million input tokens and $10 per million output tokens through August 31, after which it moves to $3 and $15.

How Does Sonnet 5 Handle Cybersecurity Tasks?

One of the most notable design choices in Sonnet 5 is what it deliberately cannot do. The model was not trained for cybersecurity work and cannot build a working exploit, scoring far below Opus 4.8 and Mythos 5 on offensive cyber tasks. It still ships with cyber safeguards enabled by default, matching those in Opus 4.7 and 4.8.

This design reflects a broader industry debate about how to handle models with dangerous capabilities. While OpenAI's GPT-5.6 series, particularly the flagship Sol model, is positioned as the company's strongest model yet for security tasks including vulnerability research and exploitation, Anthropic is taking a different approach. By shipping Sonnet 5 without offensive cyber capabilities, Anthropic can deploy it broadly without the friction of government review processes that more dangerous models require.

Why Is the Industry Suddenly Focused on AI Safety Standards?

The urgency around safety standards stems from a two-week saga that just concluded. In mid-June, the US Government imposed export controls on Anthropic's Fable 5 and Mythos 5 models, citing national security concerns and requiring the company not to provide the technology to non-US citizens. The controls were lifted after Anthropic worked closely with the government to address the security concerns.

What emerged from that dispute is striking: the vulnerability that triggered the export controls was not unique to Fable 5. Anthropic's testing confirmed that many less capable models, including Claude Opus 4.8, GPT-5.5, and Kimi K2.7, could identify the same vulnerabilities as Fable 5 did in the report. When it came to demonstrating how to exploit the single vulnerability, every model tested could produce the same demonstration as Fable 5, including Claude Haiku 4.5, Sonnet 4.6, Opus 4.6, Opus 4.7, Opus 4.8, GPT-5.4, GPT-5.5, and Kimi K2.7.

"There's currently no consensus in the AI industry on how to describe, in objective terms, the severity of an AI jailbreak. This adds a great deal of uncertainty whenever a new jailbreak technique is discovered: developers have no agreed-upon standard for which findings to focus on most urgently, and governments have no agreed-upon standard for when to act," Anthropic stated in a public announcement.

Anthropic, AI Safety Statement

In response, Anthropic is partnering with Amazon, Microsoft, Google, and other industry partners to draft a consensus framework for assessing the severity of AI jailbreaks and how AI developers should respond to them. The company is inviting other industry partners and model providers to join the effort.

Steps to Understanding the New AI Safety Framework

• Jailbreak Severity Assessment: The industry is developing objective standards for describing how dangerous an AI jailbreak actually is, moving beyond subjective judgments that can trigger unpredictable government action.
• Developer Response Guidelines: Clear standards will help AI companies understand which findings to prioritize and how quickly they need to respond to security reports.
• Government Coordination: Establishing agreed-upon thresholds for when regulators should intervene will reduce the uncertainty that led to the recent export controls on Fable 5 and Mythos 5.
• Pre-Release Government Access: Anthropic is formalizing a process where government officials can review powerful models before public release, reducing the risk of surprise regulatory action after launch.

What Does This Mean for the Broader AI Market?

The contrast between Anthropic and OpenAI's approaches is sharp. OpenAI previewed GPT-5.6 behind a government access gate, sharing partner names with US officials before any wider release. The company stated plainly that it does not want this kind of government review to become the standard path for future launches, framing the current step as a short-term move while it works with the Administration on a cyber Executive Order framework.

Meanwhile, Anthropic's strategy appears to be splitting its model lineup: the dangerous-capability models routed through government gates and verification programs, and the broadly available workhorses like Sonnet 5 kept deliberately weak on offensive cyber so they can ship to everyone without the same friction. This approach suggests that frontier AI labs are converging on a two-tier system where capability and regulatory burden are explicitly linked.

The broader context matters here. Every top-10 frontier AI model now claims a 1-million-token context window, a specification that has become table stakes in the industry. Two years ago, 128,000 tokens was the frontier norm. The spec that used to separate a premium model from a commodity one has become standard, and the number that now separates models is how much of that window a model can actually use effectively.

Claude Fable 5 launched June 9, 2026 with 1 million tokens as its default context at Anthropic's standard $10-per-million-token input and $50-per-million-token output pricing. GPT-5.5 shipped with the same 1 million-token ceiling in the API at $5 input and $30 output per million tokens. Even open-weight entrants cleared the bar, with GLM-5.2 and DeepSeek V4 Pro both listing 1-million-token windows.

The race to larger context windows reflects a fundamental shift in how AI models are being used. The reasoning-model era pushed agentic workloads that simply need more room: an autonomous coding agent reading a full repository, a research agent digesting dozens of source documents, or a long-horizon task that runs for hours and accumulates a growing transcript all consume context far faster than a single chat turn ever did. Claude Fable 5 and Claude Mythos 5 were built explicitly for "long-horizon agentic work," per Anthropic's own framing, meaning the context window grew because the tasks did.

What remains to be seen is whether the industry's new safety framework will hold up as these models become more capable and more widely deployed. The export control dispute over Fable 5 revealed that government and industry have fundamentally different risk tolerances and timelines. Anthropic's push for consensus standards is an attempt to bridge that gap before the next crisis forces another round of emergency negotiations.