Claude Opus 5.5 launch: one API string changes, 20% cheaper tokens, 85% fewer successful injections

Anthropic ships Claude Opus 5.5

Anthropic released Claude Opus 5.5 on September 22, 2026, and for developers who call the Claude API the most visible change is a single string: the model identifier moves from claude-opus-5 to claude-opus-5-5. Behind that swap sit material changes, according to a dev.to migration guide: input pricing drops from $5 to $4 per million tokens and output from $25 to $20, a 20% cut in both directions. Output can now reach 128,000 tokens in a single response, the context window is 1 million tokens, and Anthropic says the model can stay on one task for 18 hours or more, produce output 30% faster than Opus 5, and cost 40% less to operate. A fast mode is listed at $8 input and $40 output per million tokens, and the launch material also cites an OSWorld 2.0 score of 81.8% for computer use. Availability spans the Claude Platform, AWS, GCP and Azure, and the rollout landed alongside new OpenAI releases in the same week.

The guide cautions that the 20% and 40% figures are not the same claim. A per-token reduction alone cannot halve a bill; the remainder must come from the model finishing the same work with fewer tokens, which is workload-specific. The dev.to posts deliberately leave several Opus 5 comparison figures blank rather than reconstruct them from memory, so teams should pull both sides of the table from Anthropic's pricing page before forecasting savings.

A migration of budgets, not breaking changes

According to the dev.to guide, the earlier jump from Opus 4.8 to Opus 5 was a corrective migration: request patterns that used to work began returning hard 400 errors. Moving from Opus 5 to 5.5 is different, because existing code keeps working while nearly every measured number changes. A 128,000-token response takes minutes rather than seconds, which outlasts default read timeouts in most SDKs and reverse proxies; gateway buffers may hold or cut multi-megabyte bodies mid-flight; non-streaming calls offer no intermediate checkpoints; and hitting max_tokens in the middle of a JSON object produces invalid output, so stop_reason should be checked before parsing.

Cache pricing is the largest shift in the table. Cached reads cost $0.20 per million tokens against $4 for fresh input, a 95% discount, while cached writes cost $5, a $1 premium over uncached input. The guide's worked example: a 200,000-token system prompt across ten calls costs about $8 with fresh input each time, versus roughly $1.36 when written to cache once and read nine times. Since each subsequent read saves $3.80 per million tokens, caching pays off if a prefix is reused even once — provided the cache_creation and cache_read fields in the usage block actually confirm the hit.

What the 85% security figure says, and what it does not

Two dev.to security analyses unpack the headline claim of 85% fewer successful boundary-breaking attempts than the previous model, and each lands on the same caveats. The figure is relative, not absolute: roughly 15 of every 100 attacks that previously succeeded still do, and without the baseline rate the absolute floor is unknown. It was measured on the model inside Anthropic's own harness, using its prompts, tool definitions and notion of a boundary, not yours. And boundary-breaking is a broader class than indirect prompt injection, also covering jailbreaks, instruction leakage and models rationalising destructive actions, so one aggregate number cannot isolate the specific failure mode a given team cares about.

What the figure cannot speak to at all is consequence. Real incidents in this space share a shape: one injection succeeds, and the damage is determined entirely by what the agent's credentials can reach. One analysis illustrates this with a support-triage agent whose ticket API returns a perfectly well-formed response containing hostile text in a user-supplied field, instructing it to approve a refund and omit the step from its summary. The 85% is a claim about how often a model falls for that pattern; it is not a claim that a write endpoint should have been reachable by a triage agent in the first place.

Long context and long tasks cut both ways

The analyses also flag a second-order effect: two of Opus 5.5's headline features widen the attack window. A 1-million-token context allows far more untrusted material to sit in context simultaneously, and an 18-hour task horizon means an instruction planted in the second hour can remain dormant until the fourteenth, long after the human who approved the run has stopped watching.

Why it matters

Opus 5.5 lowers unit costs, raises output ceilings and extends task duration, and each of those changes alters unit economics, timeout budgets and parser assumptions at the same time. But the security number describes a property of the model, not of your stack. The practical conclusion from the dev.to writers is to treat the 85% as a reason to re-test rather than a green light to grant agents write access, and to assert against the calls an agent actually makes rather than the prose it produces. At the new $4/$20 rates, a 250-case adversarial suite against the new model costs single-digit dollars per run, which removes budget as an excuse for skipping it.