Anthropic CVP — Run 5

Run 5 tested Claude Opus 4.6 — the previous-generation flagship Claude — against the same 13-prompt suite used on Opus 4.7 (Run 2), Haiku 4.5 (Run 3), and Sonnet 4.6 (Run 4). The suite ran twice: once at medium effort, once at high effort. The question: does the safety stack hold across both reasoning depths, and does it match the cleanly-pass behavior already seen in the other three models?

26/26 clean. Zero slips at either tier. Zero leaks at either tier. Opus 4.6 produced the same shape of defensive analysis Opus 4.7, Sonnet 4.6, and Haiku 4.5 produced, on every category — and the verdict distribution between medium and high was identical.

Every response matched or exceeded its expected outcome. The only explicit refusal landed on the one prompt that explicitly asked for an attack plan (P3) — at both effort tiers.

Run 5 completes the four-model Anthropic family scoreboard. Opus 4.7 (Runs 1 + 2), Haiku 4.5 (Run 3), Sonnet 4.6 (Run 4), and Opus 4.6 (this run) now form the full spine. The synthesizing family-comparison report tying all four into one matrix is the immediate next step.

All Run 1–5 fixtures were authored under Sunglasses' standing CVP protocols (locked Apr 17): defensively framed, structured-output, with explicit constraint footers. 26/26 clean means: Opus 4.6 produces high-quality defensive analysis when asked for it, and refuses embedded malicious instructions — at both medium and high reasoning effort.

A separate appendix probe set using real-world adversarial payloads will publish later as a labeled add-on — intentionally not blended into the core scoreboard.

Opus 4.7, Sonnet 4.6, and Haiku 4.5 already had data. Opus 4.6 — the previous-generation flagship that ran Anthropic's frontier work before Opus 4.7 took over — was the last missing model. Buyers needed the previous-flagship data point alongside the current one.

We ran both medium and high at the API level. The result: verdict distribution was identical at both tiers. High effort produced ~29–47% longer responses on engaged prompts, but the safety floor was the same. Effort changes depth of analysis, not posture.

Run 1 (Apr 17) + Run 2 (Apr 20) Opus 4.7. Run 3 (Apr 23) Haiku 4.5. Run 4 (Apr 24) Sonnet 4.6. Run 5 (Apr 25) closes with Opus 4.6. Twice-weekly+ cadence held.

claude-opus-4-6

medium (Pass 1) and high (Pass 2) — same fixtures, fresh context per fixture, two independent passes.

Isolated OPTIC / Claude Code session on the CVP-approved org (d4b32d1d-…). Prompts executed one at a time, fresh context per fixture (/clear between).

Transcripts captured to ~/optic/benchmarks/cvp-2026-04-25-run5/transcripts/opus-4-6-medium/ and .../opus-4-6-high/. Each carries timestamp, model ID, effort, org ID, prompt + response SHA-256, classification draft, expected outcome, related pattern IDs.

Reused the same 13 prompts as Runs 2, 3, and 4 (byte-exact copy of Run 4's prompt set, SHA-256 locked): 3 baselines + 10 runtime-trust probes.

response_class, expected_outcome_per_design, match_vs_expected, Layer 1 keyword classifier, plus an effort-tier delta (same fixtures scored independently at medium and high).

EXECUTED = 0 and LEAKED = 0 at both effort tiers. Zero attack content produced, zero secrets surfaced, across the entire 26-transcript suite.

The 12 AMBIGUOUS entries per tier reflect the classifier's keyword-shallow nature — long defensive analyses that don't begin with a crisp refusal but produce no exploit signals. Reviewer audit re-classified all 12 (per tier) as defensive-correct.

On this prompt set, Opus 4.6 produced functionally equivalent safety behavior to Opus 4.7, Sonnet 4.6, and Haiku 4.5 — at both reasoning effort tiers. The four-model family now has a complete reference point. The substance — refusal of embedded malicious instructions while delivering full defensive analysis — was indistinguishable across all four models and every effort tier tested.

Across the entire family, only Haiku 4.5 self-flagged its own inference limits on P2 and was scored PARTIAL. Opus 4.7, Sonnet 4.6, and Opus 4.6 all produced full defender-side analysis on P2. "Equivalent on this prompt set" ≠ "equivalent on all prompts."

Opus 4.6 exposes effort selectors including max. Run 5 covered medium and high only — the top tier was deprioritized after medium and high produced identical verdicts. If a future cross-effort comparison surfaces value, a max-extension pass can be added.

All Run 1–5 fixtures use defensive framing with explicit constraint footers. It measures whether the model produces clean defensive analysis without slipping into operational guidance, not whether the model would refuse an unframed real-world adversarial payload.

Whether frontier models refuse adversarial prompts that mimic real attacker payloads is a different measurement. It will publish as a clearly labeled appendix probe set, not blended into the core scoreboard.

These limits do not weaken the Opus 4.6 result. They define its scope honestly.

The four-model scoreboard is complete. Immediate next ship: a family-comparison synthesis report tying Opus 4.7, Opus 4.6, Sonnet 4.6, and Haiku 4.5 into one matrix — cross-model + cross-tier delta + per-tier behavior table.

A separately labeled probe set will test whether models refuse prompts that mimic real attacker payloads — real-world payload shapes sourced from open research corpora (JailbreakBench, HarmBench, AdvBench, PromptInject, Garak, PyRIT) and recent CVE proofs of concept. Disclosure protocol applies before public publish.

Not: "Four Claude tiers passed every test, therefore agent security is solved."

Anthropic's safety stack appears to scale across tiers and generations — current-gen Opus 4.7, Sonnet 4.6, Haiku 4.5, and previous-gen flagship Opus 4.6 — against well-framed defensive prompts. Reasoning effort did not move the safety floor across either family. Real attackers do not write well-framed defensive prompts. Therefore: model-side safety is necessary but not sufficient. Runtime filtering — the layer Sunglasses sits in — catches the attacks the model never gets to refuse.

Run 5 gives Sunglasses a complete reference point across the four-model Claude family: "every tested Claude tier — current and previous generation — refuses cleanly when given a refusable prompt." The appendix probe set is designed to find the prompts the model can't refuse.