Anthropic ships Claude Sonnet 5 as the new default – agentic performance near Opus, at Sonnet pricing

Claude Sonnet 5 went live on June 30, 2026 and is now the default model for Free and Pro users. Anthropic's pitch is squarely agentic: planning, tool use across browsers and terminals, and autonomous runs at a level that used to require a larger, pricier model.

According to Anthropic, safety evaluations show a lower rate of undesirable behavior than Sonnet 4.6 – a meaningful claim if it holds up under independent scrutiny, since agentic capability and safety regressions have historically moved in opposite directions as models get more autonomous.

The practical angle

Introductory pricing runs through August 31, 2026 before stepping up, which is worth flagging if you're budgeting API usage past that date.

If you've got Claude wired into your own tooling – internal agents, CI pipelines, security automation – the standard caution applies: benchmark the new model against your own existing evaluation set before switching wholesale. Agentic gains that look good on a general benchmark don't always survive contact with a specific, narrow workflow you've already tuned around a previous model's quirks.

What a default-model switch changes overnight

When a vendor flips the default model, the change lands on everyone who never made an explicit choice, which in consumer products is most people. Overnight, the same prompts start producing different outputs, guardrails behave slightly differently, and any workflow implicitly tuned to the old model's behavior shifts under your feet. For casual chat that is cosmetic; for anything wired into a business process, it is a silent dependency change that no changelog in your own systems will record.

API users have more control, and should use it: pin an explicit model version rather than a floating alias, so upgrades happen when you decide, not when the vendor does. Then treat the migration like any other dependency bump – re-run your evaluation set, re-test the failure modes you have already worked around, and pay particular attention to how the new model handles adversarial inputs in your context, since a model that follows instructions more capably also follows injected instructions more capably.

Why this belongs in a security newsroom

Every jump in agentic capability – a model that can drive a browser, a terminal, and multi-step tool chains more reliably – is also a jump in what a compromised or misdirected agent can do unsupervised. The security-relevant question isn't just "is the new model good", it's "what's the blast radius if a prompt injection or bad tool result steers this agent somewhere you didn't intend."

Frequently asked questions