Claude Opus 5.5 hands flagged cyber requests to Opus 4.8 — and Anthropic's own tests say that fallback is where prompt injections land

XDA Developers reported on October 17 that Claude Opus 5.5 keeps quietly switching to Opus 4.8. That is documented behavior, not a bug: Anthropic’s Opus 5.5 launch post (September 22, 2026) says “most cybersecurity tasks will be re-routed to Opus 4.8.” The builder question is different: if your agent reads code or pages you didn’t write, should you let that switch happen automatically?

What triggers the switch

Per the Claude Code model configuration docs, Opus 5.5 (like Fable 5.1 and Fable 5) re-runs cybersecurity-flagged requests on Opus 4.8 and biology-flagged requests on Opus 5. Sonnet 5.5 falls back to Sonnet 5 for cyber flags; Haiku 5.5 has no fallback at all.

Anthropic’s Cyber Verification Program page lists what normally stays on the flagship: secure code review, threat modeling, patching known issues, finding vulnerabilities in your own source code, and triaging alerts. Malware analysis or exploit validation “may be interrupted.”

Why the fallback matters for agents

The Sonnet 5.5 system card runs Gray Swan’s Shade attacker against 40 coding scenarios, 200 attempts each. Many injected instructions tell the agent to wipe a disk or delete files, which trips the cyber classifier and moves the request to the older model:

Sonnet 5.5 coding injection test	Result
Requests served by Sonnet 5 after a cyber block	25%
Of those, compromised	12.01%
Requests Sonnet 5.5 answered itself, compromised	4 of 5,901 (0.07%)

The Haiku 5.5 system card (October 7) puts Opus 5.5 at a 54.61% attempt-level attack success rate on the same test without probes (11.13% with probes), versus 0.08% for Haiku 5.5. Anthropic says fallback explains the gap: on requests they answered themselves, Opus 5.5 and Fable 5.1 “were never compromised.”

To be fair to the design: on a second benchmark in the Sonnet 5.5 card, fallback made no difference, with 1 of 777 fallback-served rollouts compromised (0.13%) versus 18 of 6,347 others (0.28%). The weak spot shows up when an attacker can deliberately trip the classifier.

Claude Code: make it ask first

By default Claude Code re-runs the flagged request on the fallback model, shows a notice, and the session continues on that model until you run /model. To get a prompt instead:

• run /config, pick Switch models when a message is flagged, choose Ask each time, or
• set "switchModelsOnFlag": false in your settings file.

Caveats from the docs: subagents still re-run on the fallback model without asking; non-interactive (-p) and SDK sessions end the turn with a refusal; category-based fallback needs Claude Code v2.1.219 or later. XDA reports a similar toggle in the Claude app; we haven’t verified its path.

API: fallback is opt-in and visible

On the API nothing switches unless you ask. Per Refusals and fallback, a decline is an HTTP 200 with stop_reason: "refusal" and a stop_details.category such as "cyber". Server-side fallback (beta) needs fallbacks: "default" plus the server-side-fallback-2026-07-01 header, or a list of up to three models you name. Check the top-level model field and look for a fallback_message entry in usage.iterations. Note sticky routing: for about an hour, later turns in that conversation go straight to the fallback model. Server-side fallback isn’t available on Batches, Bedrock, Google Cloud or Foundry.

What to do

For agents that ingest repos, inboxes or web pages, set switchModelsOnFlag to false and keep destructive tools behind permission prompts. Our notes on how Anthropic sandboxes Claude cover that layer. On the API, log response.model so a fallback never goes unnoticed. If cyber flags block real defensive work, the Cyber Verification Program now has three tiers, and individuals can apply only for Defense access. For background, see how this fallback began with Fable 5’s guardrail reversal, and why Haiku 5.5 works as a cheap subagent.