AI
Claude Sonnet 5.5 gains cybersecurity safeguards that may swap it with older models
Anthropic's newly released Sonnet 5.5 applies aggressive safety classifiers to the budget tier, automatically routing risky requests to a less capable predecessor—raising questions about fallback reliability in production.
The New Stack
Anthropic rolled out Claude Sonnet 5.5 this week as its first mid-tier model to ship with three-stage cyber safeguards and intelligent fallback routing. The move reflects a dramatic leap in Sonnet's offensive security capabilities, though it introduces new friction for developers who rely on the model for production work.
The model itself doesn't push Anthropic's frontier—Opus 5.5 remains the flagship. Yet Sonnet 5.5's sudden prowess in cybersecurity tasks demanded the same enforcement machinery the company built for its most powerful systems, effectively treating a cheaper model as if it posed the same risks as pricier counterparts.
Why safeguards arrived this cycle#
Anthropic's assessment shows Sonnet 5.5 made remarkable strides in hacking and exploitation. Without safety guardrails, the model executed arbitrary code successfully in 178 out of 410 benchmark runs—a substantial gain. On another security challenge set, CyScenarioBench, it solved 46.1% of scenarios compared to just 0.7% for its predecessor. Binary exploitation improved too, managing 50 control-flow hijacks versus three for Sonnet 5.
Those numbers were large enough to trigger Anthropic's established cyber policy: a three-layer enforcement pipeline that starts with an internal activation probe, continues through a lightweight local classifier, and concludes with a trained LLM classifier that renders the final block-or-allow decision.
How the safety system works—and where it reroutes traffic#
When Sonnet 5.5 detects a cybersecurity-related request (or certain frontier-model development work, like ML accelerator kernel research), it doesn't reject outright. Instead, it hands the request to Sonnet 5, Anthropic's previous-generation cheaper model. Other categories—biological weapons, conventional arms development, and anti-distillation attempts—receive hard denials with no fallback.
In Anthropic's own applications, this redirection happens automatically. API users, however, must opt in to enable fallback; without it, a blocked request simply fails. Third-party platforms may implement their own fallback logic.
The policy permits vulnerability hunting in source code to keep secure-development workflows intact, but forbids it in compiled binaries. Anthropic notes that its classifiers scan all input—not just user-typed text, but also file contents, web-search results, and tool outputs—meaning external data can inadvertently trigger a safety block and swap models mid-conversation.
