On September 28, 2026, Anthropic released Claude Sonnet 5.5, the second model in its latest family and a clear upgrade over its predecessor. The model runs 30%+ faster, costs up to 30% less per task, and maintains the same pricing – $2 per million input tokens, $10 per million output tokens. In agentic coding, the jump is dramatic: 70.6% on Terminal-Bench 4.0, up from Sonnet 5’s 10.3%. On GDPval-AA knowledge work, it scores 1844 – nearly matching the 1846 of the larger Opus 5.5.
The technical gains are real. But the product ships with something else: the most aggressive safety architecture Anthropic has ever put on a mid-tier model. Sonnet 5.5 is the first Sonnet to launch with cyber safeguards comparable to Opus 5.5, including safety classifiers designed to prevent reasoning extraction through distillation attacks. On Anthropic’s automated behavioral audit across roughly 1,850 scenarios, the model improves on or matches Sonnet 5 on most alignment measures. It is, according to Anthropic, the least likely of any of its models to probe the limits of its own containers.
Three days before this release, a D.C. Circuit ruling classified those very safety restrictions as a national security liability. On September 25, in Anthropic PBC v. Department of War, Judges Katsas and Rao upheld the Pentagon’s determination that Anthropic’s refusal to support lethal autonomous warfare and mass surveillance constitutes a supply chain risk under FASCSSA § 4713. Judge Henderson dissented, warning of sweeping leverage over contractors’ policy choices. Anthropic is evaluating further proceedings, including a potential en banc rehearing or Supreme Court petition.
The collision is structural, not incidental. Anthropic is marketing safety as its competitive moat – the reason enterprise customers should choose Claude over alternatives. The court has ruled that this same safety moat can be legally reclassified as a defect. For a company managing a delayed S-1 prospectus with a $2 trillion valuation target, the contradiction is material. How does the prospectus describe safety as a competitive advantage when a federal appeals court has classified that advantage as a defense supply-chain risk?
The timing compounds the pressure. OpenAI’s DevDay arrives tomorrow, September 29, with the company needing to counter after two training halts in three months. The competitive window for Anthropic widens – while OpenAI pauses, Anthropic ships. The formation of the SAFA safety standards body on September 27 by Anthropic, Google, and OpenAI arrived three days after OpenAI’s second training halt, suggesting the industry is scrambling to regain narrative control over safety before regulators fill the vacuum.
Sonnet 5.5’s benchmark gains – the 40-percentage-point jump on Terminal-Bench 4.0, the near-parity with Opus 5.5 on knowledge work – position it as the strongest mid-tier model in the market. At the same price as Sonnet 5, the value proposition is straightforward: near-frontier capability at half the cost of Opus. For developers building agents, coding tools, and enterprise workflows, the efficiency gains are immediate and measurable.
But the safety features carry a weight that benchmarks cannot capture. Cyber safeguards that fall back to the previous model for higher-risk tasks, distillation classifiers that prevent reasoning extraction, containment metrics that outperform every prior Claude model – these are not just technical enhancements. They are the operational expression of a safety philosophy that a federal court has now classified as a potential obstacle to national security.
Anthropic is, in effect, shipping a product whose core differentiator has been legally challenged by the government it hopes to serve. The structural tension will not resolve cleanly. Anthropic’s safety positioning is too deeply embedded in its brand, its engineering culture, and its regulatory strategy to abandon. The D.C. Circuit ruling is too consequential to ignore. And the S-1 prospectus – whenever it arrives – will have to thread a needle that a federal appeals court has just made thinner.