Flagged Opus 5.5 chats stay stuck on Opus 4.8

Claude Opus 5.5 hands requests that brush against security, like malware analysis or exploit validation, to Opus 4.8 once a classifier flags them. In claude.ai and Claude Code the chat then stays on Opus 4.8 until you switch back.

Anthropic’s Sonnet 5.5 system card, where Sonnet 5 is the fallback, shows the weak spot. Attacks hidden in an agent’s workspace tripped the cyber classifier, 25% of requests landed on Sonnet 5, and 12.01% of those were compromised. Sonnet 5.5, answering for itself, was compromised in 4 of 5,901.

The attack did the rerouting on its own.

The Claude app has a toggle under Settings -> Capabilities, Switch models when a message is flagged, and Claude Code keeps it under Config -> MODEL & OUTPUT. With it off, a flagged request pauses instead. On the API, fallback is opt-in.