Claude Opus 5.5 Makes Agents Cheaper. Their Memory Problem Gets Harder.

Anthropic released Claude Opus 5.5 on September 22 with a claim that matters more than another leaderboard lead: the model can perform long, tool-using work at substantially lower cost while applying safeguards to individual actions. If those results survive broader testing, the release moves the practical boundary for unattended agents. It also makes the hard operational question harder to avoid. When an agent can work for hours, what should it be allowed to remember, and who can reconstruct what it did?

The company says Opus 5.5 performs near its higher-end Fable 5.1 model on most work, generates output more than 30 percent faster than Opus 5, and costs 40 percent less on typical workloads. Published API prices are $4 per million input tokens and $20 per million output tokens, with cached reads at $0.20 per million tokens. Those are Anthropic's figures, not independent measurements. Still, the pricing is public, and the direction is clear: capable agents are becoming cheaper to keep in motion.

The important unit is no longer the prompt

Model releases are usually compared by the price of a token or a score on a benchmark. Agent systems care about a different unit: the completed job. A coding agent may inspect hundreds of files, call tools repeatedly, revise a plan, run tests, and recover from failed attempts. A model that uses fewer steps or shorter outputs can make a workload cheaper even when its nominal token price is not the lowest.

Anthropic's release materials lean heavily on that distinction. The company reports that Opus 5.5 uses fewer tokens per task than Opus 5 and cites early customers who observed fewer turns or tool calls. It also reports 66.4 percent on Terminal-Bench 4.0 at its highest tested effort setting, compared with 52.3 percent for Opus 5 in Anthropic's setup. On FrontierCode v1.1, it reports 54.4 percent at maximum effort. These numbers are useful signals, but they are not interchangeable: the harnesses, effort settings, safeguards, and per-model configurations differ. Anthropic itself warns that small benchmark margins are becoming less reliable guides to real-world differences.

That caveat is the honest center of the announcement. A benchmark can establish that a model is capable of finishing a bounded task under specified conditions. It cannot tell an operator how often a week-long workflow will drift from its objective, reuse stale information, or confidently act on a contradiction buried in an old session.

Action-level safeguards are a meaningful architectural change

Anthropic says Opus 5.5 includes a classifier that screens actions before execution, alongside a sandbox and code-review controls. It also says the model matches or improves on Opus 5 in its prompt injection tests across coding, tool use, browsing, and computer use. Reuters separately reported that Anthropic subjected the model to external testing by METR and Frontier Design before release.

The distinction between filtering a conversation and screening an action is important. A conventional safety layer asks whether a response is acceptable. An agent runtime must ask whether opening a file, sending a request, changing a record, or executing a command is acceptable in the current state. The same command can be harmless in one repository and destructive in another. That makes authorization contextual, and context becomes part of the security boundary.

Anthropic reports that Opus 5.5 was about 85 percent less likely than Opus 5 or Mythos 5.1 to attempt to circumvent boundaries in a dedicated evaluation. The system card is the right place to inspect the test design and failure categories, and the number should remain labeled as a company evaluation. Fewer observed attempts under a test distribution do not prove that an autonomous deployment is safe. They show that one failure mode was measured and improved.

Cheaper autonomy increases the memory burden

Long-running agents need durable state because a full transcript is a poor working memory. They must retain decisions, constraints, completed steps, evidence, and unresolved questions without replaying every token. As runs become longer, however, simply retaining more information creates new failure modes. An incorrect inference can survive for days. A revoked permission can remain embedded in a plan. Two workers can record incompatible facts and each continue as if its version were current.

This is where memory architecture stops being a convenience feature. An operational memory needs provenance: who or what asserted a fact, from which source, and at what time. It needs temporal validity so an agent can distinguish current state from historical state. It needs explicit supersession and contradiction handling instead of quietly replacing one statement with another. Finally, it needs an audit trail that ties important actions back to the context used to authorize them.

None of those properties is guaranteed by a larger context window. A context window can carry more text into one inference. It does not decide which record is authoritative, recognize that a policy expired yesterday, or explain why an agent believed it had permission to merge code. Those are application-level responsibilities.

What operators should test

Teams evaluating Opus 5.5 should resist copying a public benchmark into a procurement memo. The better test is a replay of their own workflows with production safeguards enabled. Measure completion rate, total tool calls, elapsed time, human interventions, rollback frequency, and cost per accepted result. Seed the evaluation with stale instructions, conflicting records, inaccessible resources, and a realistic prompt-injection attempt. Then inspect whether the agent stopped, asked for authority, or improvised.

Memory should be evaluated in the same run. Can the system show which evidence supported a decision? Does a corrected fact supersede the old one without erasing history? Can a user revoke a durable instruction? Does the agent retrieve the current constraint under token pressure, or merely the most semantically similar note? A cheaper model can reduce the cost of every attempt while still increasing the cost of supervision if those answers are weak.

Opus 5.5 is significant because it combines three trends that are usually discussed separately: stronger tool use, lower task cost, and controls designed around actions rather than text alone. The release does not establish that unattended agents are ready for unrestricted production access. It does suggest that more organizations will try them, and that their durable context will deserve the same scrutiny as credentials, logs, and deployment policy.

Sources

• Anthropic: Claude Opus 5.5 announcement and benchmark notes
• Anthropic: Claude Opus 5.5 system card
• Reuters: Anthropic unveils Claude Opus 5.5