Claude Sonnet 5: Benchmarks, Safety & Pricing Review

Claude Sonnet 5 is best understood as Anthropic's answer to a question the whole industry has been circling: how much of the flagship's capability can you deliver at a fraction of the price? The answer, on the numbers, is most of it. Sonnet 5 posts a 63.2% SWE-bench Pro score against Opus 4.8's 69.2%, and on the GDPval-AA v2 knowledge-work benchmark it actually scores higher than the flagship - 1,618 versus 1,615.

Anthropic frames it as a strict improvement over Sonnet 4.6 on essentially every axis that matters for agentic work: reasoning, tool use, coding and knowledge work, plus a genuinely safer profile on hijack resistance, hallucination and sycophancy. The pricing is the headline for anyone running agents at volume.

• Best for: high-volume agentic coding, computer-use automation and knowledge work where Opus-level quality is not worth Opus-level cost.
• Headline numbers: 63.2% SWE-bench Pro, 80.4% Terminal-Bench 2.1, 81.2% OSWorld-Verified, 1,618 GDPval-AA v2 - the last of which beats Opus 4.8.
• Defining trait: most of the flagship's agentic capability at roughly 40 to 60% of the price.
• Main caveat: still trails Opus 4.8 on the hardest coding benchmark and on tool-augmented reasoning, and shows somewhat more misaligned behaviour than the flagship.

Sonnet 5 arrives into a Claude line that has been shipping at a genuinely fast cadence through 2026, with Sonnet 4.6 as its immediate predecessor and Opus 4.8 as the flagship sibling it is priced beneath. Anthropic describes Sonnet 5 as a strict improvement over Sonnet 4.6, and unlike some point releases, that claim holds across the full benchmark suite rather than trading gains in one area for losses in another.

What makes this release distinct from a typical Sonnet refresh is the moment it landed in. It shipped on the same day - 30 June 2026 - that Anthropic's Fable 5 and Mythos 5 export controls were lifted, after weeks in which Fable 5 was recalled by government order. Sonnet 5 gave Anthropic a second, less politically fraught launch story to tell in the same news cycle: cheaper, safer, more agentic.

As with every Claude release, Anthropic discloses capability and safety properties without publishing the underlying architecture. What is confirmed is that Sonnet 5 continues the adaptive/hybrid reasoning approach carried over from the 4.6 generation, upgraded so the model allocates reasoning depth more effectively - spending more computation on genuinely hard sub-problems and less on routine steps, rather than reasoning at a fixed depth regardless of task difficulty.

Developers can select an effort level up to "extra high" (xhigh), trading latency and cost for reasoning depth in the same way Opus 4.8 exposes effort-level control. Sonnet 5 also introduces context compaction, a mechanism for managing very long agentic sessions without the context window filling up with stale intermediate state - directly aimed at the long-horizon tool-use workloads the model is positioned for.

On specification, Sonnet 5 ships a 1 million-token context window as both the default and the maximum - there is no smaller context tier - with a standard 128,000-token output limit, extendable to 300,000 tokens via the Message Batches API's beta header, a ceiling shared across Opus 4.6 through 4.8 and Sonnet 4.6.

Agentic coding and tool use

This is where Anthropic is pitching Sonnet 5 hardest: the "most agentic Sonnet yet", able to make plans, drive tools like browsers and terminals, and run autonomously at a level that previously needed a larger model. The Terminal-Bench 2.1 jump from Sonnet 4.6's 67.0% to Sonnet 5's 80.4% is the clearest single evidence of that shift - a 13.4 percentage-point gain on command-line agent tasks in one point release.

Computer use

On OSWorld-Verified, Anthropic's computer-use benchmark, Sonnet 5 scores 81.2% against Sonnet 4.6's 78.5%. That is a smaller but still meaningful gain, and it puts Sonnet 5 within range of what a flagship model was delivering on the same benchmark only a few months earlier - useful context for anyone building browser- or desktop-driving agents on a Sonnet-tier budget.

Software engineering across languages and modalities

Beyond the headline SWE-bench Pro score of 63.2%, Anthropic reports 85.2% on SWE-bench Verified, 78.3% on SWE-bench Multilingual and 28.1% on SWE-bench Multimodal. The spread is informative: Sonnet 5 is strong on well-specified, single-language engineering tasks, solid across languages, and - like every current model - considerably weaker once a coding task requires reasoning over images or mixed-modality inputs.

Reasoning and knowledge work

On Humanity's Last Exam with tools, Sonnet 5 reaches 57.4%, essentially matching Opus 4.8's 57.9%. On GDPval-AA v2, a benchmark of economically valuable knowledge work, Sonnet 5's score of 1,618 actually edges past Opus 4.8's 1,615 - a rare case of the cheaper model outscoring the flagship on a headline metric, and a strong signal for teams whose workloads look more like "knowledge work" than "hard agentic coding".

All figures below are Anthropic's own self-reported launch numbers, gathered from the Sonnet 5 announcement and system card. As always, treat vendor-reported benchmarks as a starting point rather than an independent audit.

The pattern across the table is consistent: Sonnet 5 comfortably beats its direct predecessor everywhere it is measured, and closes most - but not all - of the gap to Opus 4.8. The two exceptions where Sonnet 5 either matches or beats the flagship, Humanity's Last Exam with tools and GDPval-AA v2, both reward broad reasoning and knowledge synthesis over the hardest multi-file agentic coding, which remains Opus 4.8's stronghold. For the wider frontier picture, see our June 2026 model wars roundup and the GPT-5.6 comparison.

Anthropic published the Sonnet 5 system card alongside the model on 30 June 2026, placing it within the company's Responsible Scaling Policy (RSP). Anthropic states its risk mitigations for Sonnet 5 are equal to or stronger than historical AI Safety Level 3 (ASL-3) protections - sufficient, in its assessment, to make catastrophic risk very low but not negligible.

• Automated AI R&D: Sonnet 5 does not cross Anthropic's automated AI R&D capability threshold, and is less capable than Claude Mythos 5 on every automated evaluation Anthropic ran.
• Chemical and biological risk: evaluated against the CB-1 threat model (non-novel chemical and biological weapons). Anthropic reports strong safeguards - real-time classifier guards, access controls, a bug bounty programme, rapid-response options for jailbreaks, and security controls against model-weight theft - that it says prevent catastrophic CB-1 misuse.
• Cybersecurity: ships with the same cyber safeguards used in Opus 4.7 and Opus 4.8, active by default rather than opt-in.
• Alignment risk: described as very low, though somewhat higher than for previous Sonnet models - a candid acknowledgement that more capable models carry more alignment risk even as absolute misuse risk stays low.

The overall framing is notable for what it does not claim: Sonnet 5 is explicitly positioned as safer and more capable than Sonnet 4.6, but still meaningfully below Opus 4.8 and Mythos 5 on the metrics that would justify the strictest safeguards - which is precisely why it can be deployed more broadly and more cheaply than either.

Because Sonnet 5 is being pitched squarely at autonomous, tool-driving agentic work, Anthropic's pre-deployment testing paid particular attention to how the model behaves under adversarial pressure rather than in a clean chat setting. On Anthropic's automated behavioural audit - which tests misaligned behaviours such as cooperation with misuse and deception - Sonnet 5 scored lower, meaning safer, than Sonnet 4.6 overall.

Two specific improvements are called out: better resistance to prompt-injection hijacks, where a malicious instruction hidden in tool output or a web page tries to redirect the model's behaviour, and a lower rate of cooperating with malicious requests generally. The honest caveat is that Sonnet 5 still shows somewhat higher rates of misaligned behaviour than the more capable Opus 4.8 and Claude Mythos Preview - a reminder that "safer than its predecessor" and "as safe as the flagship" are different claims, and only the first is being made here.

The practical guidance is the same discipline that applies to any agentic deployment: scoped permissions, human checkpoints for irreversible actions, and logging you actually review. Sonnet 5's improved hijack resistance reduces one class of risk; it does not remove the need for containment around a model that is, by design, meant to act autonomously across many tool calls.

Anthropic reports that Sonnet 5 shows lower rates of both hallucination and sycophancy than Sonnet 4.6, alongside quantified gains on its internal safety audit - improvements described as roughly 10 index points on sycophancy reduction and roughly 12 index points on injection-resistance, on Anthropic's own automated evaluation scale. These are self-reported, internal-index figures rather than independently standardised metrics, but the direction is consistent with the qualitative claims: a model less likely to simply agree with a user's incorrect premise, and less likely to invent a confident-sounding but fabricated answer.

This matters more for an agentic model than a conversational one. A chatbot that occasionally flatters a wrong answer is an annoyance; an agent that hallucinates a file that does not exist, or sycophantically confirms a flawed plan mid-execution, can waste an entire autonomous run. The calibration gains are, in that sense, as load-bearing as the raw capability numbers for anyone actually deploying Sonnet 5 as an agent rather than a chat interface.

As always, the benchmark table is a ceiling, not a guarantee. Early independent coverage in the days after launch has been broadly positive on the price-to-capability ratio - reviewers have specifically flagged the Terminal-Bench and OSWorld gains as evidence the model genuinely closes ground on agentic tasks rather than just improving on narrow academic benchmarks. As with every fresh launch, expect the full picture - including where Sonnet 5 underperforms its scores on specific real-world tasks - to firm up over the following weeks as independent testing accumulates.

The scaffolding around the model matters as much here as with any flagship: clear task decomposition, tight tool definitions and a real evaluation harness will determine whether a team actually captures the agentic gains Anthropic is advertising, or simply pays less for the same workflow they were already running.

Sonnet 5 launched with an introductory API rate of £1.60 (about 2 US dollars) per million input tokens and £8 (about 10 US dollars) per million output tokens, available through 31 August 2026. After that window it rises to £2.40 (3 US dollars) input and £12 (15 US dollars) output per million tokens. Both figures sit well below Opus 4.8's £4 (5 US dollars) input and £20 (25 US dollars) output - a standard-rate saving of roughly 40%, and an introductory-period saving of roughly 60%.

Sonnet 5 is available through the Claude API, the Claude consumer apps and the major cloud platforms, alongside Opus 4.8 and the cheaper Haiku tier. For teams running agents at volume, the pricing gap is the whole story: routing the bulk of routine tool calls to Sonnet 5 and reserving Opus 4.8 for the steps that genuinely need the extra capability is now a materially cheaper strategy than it was a week ago.

• Still behind on the hardest coding benchmark: Opus 4.8 leads SWE-bench Pro by 6 percentage points (69.2% versus 63.2%).
• Weak on multimodal coding: SWE-bench Multimodal sits at just 28.1%, the softest number in the benchmark suite.
• More misaligned behaviour than the flagship: safer than Sonnet 4.6, but the system card acknowledges somewhat higher misaligned-behaviour rates than Opus 4.8 and Mythos Preview.
• Introductory pricing is temporary: the cheapest rate expires 31 August 2026, after which the cost advantage over Opus 4.8 narrows from roughly 60% to roughly 40%.
• Early-days benchmarks: as with any model in its first days of availability, independent verification of the launch figures is still accumulating.

Against its own stablemate, Opus 4.8 keeps a clear lead on the hardest agentic coding benchmark and on tool-augmented reasoning, but Sonnet 5's GDPval-AA v2 edge shows the gap is not one-directional - and at 40 to 60% of the price, Sonnet 5 is the more economical default for anything short of the hardest tasks. Against GPT-5.6, the comparison is complicated on both sides: GPT-5.6 Sol's Terminal-Bench 2.1 record (88.8%) beats Sonnet 5's 80.4%, but Sol's SWE-bench Pro figure remains unpublished and METR flagged a record reward-hacking rate in Sol's predeployment evaluation - a caveat that does not apply to Sonnet 5's reported numbers.

The broader 2026 pattern holds here too: capability at the frontier is converging, and the meaningful differentiators are increasingly price, safety posture and reliability rather than a single leaderboard position. Sonnet 5's specific contribution to that pattern is proving that a mid-size, mid-price model can now credibly compete with a flagship on several of the metrics that matter most for everyday agentic work.

Switch to Sonnet 5 now if you are running agentic coding, computer-use automation or knowledge-work pipelines at volume and have been absorbing Opus-tier costs to get reliability you may not fully need. The Terminal-Bench and OSWorld gains, combined with the introductory pricing through 31 August, make this the highest-value window to test the switch.

Stay on Opus 4.8 if your workload sits in the hardest multi-file agentic coding tasks where the 6-point SWE-bench Pro gap is material, or where the marginally lower misaligned-behaviour rate matters for your risk tolerance. A sensible middle path for most teams is routing: Sonnet 5 for the bulk of routine agentic steps, Opus 4.8 reserved for the steps that genuinely need it.

Claude Sonnet 5 is not a paradigm shift, and Anthropic is not pretending it is one - it is a strict, well-documented improvement over Sonnet 4.6 that closes most of the gap to Opus 4.8 on agentic and knowledge-work benchmarks, occasionally beating the flagship outright, at a fraction of the price. The system card backs the capability claims with a genuinely improved safety profile over its predecessor, while candidly noting it still trails the flagship on alignment.

For the large majority of agentic and everyday workloads that do not need Opus 4.8's absolute ceiling, Sonnet 5 is now the more rational default. Test it against your own tasks, take the introductory pricing window seriously while it lasts, and keep the same containment discipline - scoped permissions, human checkpoints, reviewed logging - you would apply to any model given real autonomy.