Claude Sonnet 5 arrived on June 30, 2026, with a familiar promise: near-Opus performance for agentic work at the lower-cost Sonnet tier. For security teams, however, the more important question is not whether it can write code or operate tools. It is whether its growing autonomy creates unacceptable cyber risk.
This review examines Anthropic’s published evidence rather than claiming an independent hands-on test. The company’s launch announcement and Claude Sonnet 5 System Card provide a repeatable evaluation context, observable outcomes and deployment details. No live targets, private access or unsandboxed prompts were used for this article.
What was evaluated
Anthropic says Sonnet 5 was not deliberately trained for cybersecurity. Its cyber-relevant ability is therefore presented as a by-product of broader improvements in reasoning and coding. The System Card reports results across several evaluations, including ExploitBench, OSS-Fuzz, CyberGym and a Firefox 147 exploit-development test.
The clearest result comes from the Firefox evaluation, developed with Mozilla. The task measured whether models could develop working exploits for vulnerabilities in Firefox 147. Anthropic reports that Sonnet 5 never produced a complete working exploit. Its working-exploit rate was 0.0%, matching Sonnet 4.6. The company also reports a slightly higher partial-success rate for Sonnet 5 than for its predecessor. The vulnerabilities used in the evaluation were patched in Firefox 148.
That distinction matters. A zero percent working-exploit result does not mean the model is incapable of assisting with security work, nor does it establish that every future task will fail. It does show that, in this published evaluation, Sonnet 5 did not complete the measured exploit-development objective. The partial-success result also suggests that general capability gains have not eliminated the possibility of useful intermediate assistance on dangerous workflows.
Safeguards are part of the product
Anthropic launched Sonnet 5 with cyber safeguards enabled by default. The company describes classifiers, or “probes,” that monitor traffic and classify cybersecurity activity. Prohibited use and high-risk dual-use work, such as developing exploits, are blocked by default. Lower-risk dual-use tasks, including vulnerability detection, are treated differently because they have common defensive applications.
This is a sensible deployment boundary, but it is not a substitute for an organisation’s own controls. A classifier can make a different decision from a security engineer, particularly when a legitimate investigation resembles offensive activity. Teams should therefore keep tool permissions narrow, isolate repositories and credentials, log model actions, and require human approval before any change reaches a production system.
Anthropic says Sonnet 5 is generally safer than Sonnet 4.6 in its pre-deployment assessments, including better refusal behaviour and stronger resistance to prompt-injection hijacking. The launch material also says that its overall undesirable-behaviour rate was lower than Sonnet 4.6, although the model did not outperform the more capable Opus 4.8 and Mythos Preview on every safety measure.
What the evidence supports
The published results support a narrow but useful conclusion. Sonnet 5 appears well suited to bounded defensive assistance: explaining vulnerability reports, reviewing code for ordinary security issues, helping document incidents and supporting routine remediation under supervision. Its agentic capabilities may improve the speed of those workflows, but the evidence does not justify treating it as an autonomous penetration tester.
The Firefox result is particularly important because it prevents a common category error. A model can be highly effective at coding, browser use and multi-step task execution while still showing limited performance on a specialised exploit-development benchmark. Conversely, a low benchmark score should not be read as proof that every cyber interaction is harmless. Sonnet 5 showed some partial success, and Anthropic itself judged that stronger safeguards were appropriate.
Security leaders should also separate model capability from service configuration. The evaluation described by Anthropic measured underlying capability without relying on the normal production safeguards. Real-world users encounter the model through a layered system that includes classifiers, account controls and product permissions. Those controls reduce risk, but they also mean that a benchmark result cannot predict the exact behaviour of every deployment.
Test verdict
Claude Sonnet 5 earns a 7.6/10 editorial score for security-conscious general-purpose use. The score reflects a positive safety trend against Sonnet 4.6, a published 0.0% working-exploit result in the Firefox 147 evaluation and explicit default cyber safeguards. It is held back by the slightly higher partial-success rate, the absence of an independently reproducible run in this review and the fact that the evidence is supplied by the manufacturer.
Our verdict is therefore qualified: Sonnet 5 is a credible assistant for routine, bounded defensive work, but the published evidence does not support using it for unsupervised exploit development, autonomous incident response or final security sign-off. Keep it inside a least-privilege environment, use synthetic or patched targets for evaluation, and treat every model-generated finding or change as a lead requiring expert verification.