Your agents read text you did not write. A customer’s issue description. A comment on a pull request. A dependency’s README. The HTML of a page one of them fetched to check how an API behaves. The error body a third-party service returned at 2am. All of it is text, and text can carry instructions.
Claude Opus 5.5 is measurably better at not following them. Anthropic reports 85% fewer successful boundary-circumvention attempts. That is real progress and it is worth the upgrade on its own merits. It is still not a guardrail, and the week it shipped is the week that distinction got more important rather than less.
TL;DR
A guardrail is a limit that holds regardless of what the agent decides to do. A model’s refusal is not one: it is a decision, and a decision can be changed by the right input. Opus 5.5 gets that decision right far more often than its predecessor did, and it does not change what a run is allowed to touch, who holds the credentials, or who reads the diff. Meanwhile it costs 40% less to run than Claude Opus 5, and GPT-6 Sol and GPT-6 Luna landed the same day at $2/$10 and $0.10/$0.50 per million tokens. The per-run failure rate went down. Your run volume is about to go up. Design for the product of the two.
When GPT-6 Astra shipped we wrote about the four things a computer-using agent needs: a host, a boundary, a record, and an acceptor. That post was about where the run happens. This one is about what happens when the run reads something hostile.
The number is a ratio, and your volume is not fixed
Incidents are a rate multiplied by a count of runs. Only one of those two terms improved on 2026-09-22.
The other moved hard the other way. Opus 5.5 lists at $4 per million input tokens and $20 per million output against Opus 5’s $5 and $25, with cached reads at $0.20, and Anthropic puts the total cost to run it 40% below Opus 5. On the other side of the same launch day, OpenAI priced GPT-6 Sol at $2/$10 and GPT-6 Luna at $0.10/$0.50, and reported Sol at extra-high reasoning scoring 33.2% on AutomationBench 1.0.6 at $0.27 per task, which OpenAI puts at roughly 9% of what Claude Opus 5 at max reasoning cost per task for a lower score.
So do the multiplication on your own team instead of on a benchmark. If the per-run failure rate drops by 85% and you run ten times as many agent runs because each one now costs a fraction of what it did, you land at about 1.5 times the absolute incidents you had before. That is not a measurement of anything. It is arithmetic, and it is the shape of the next few months. A cheaper and safer model is a reason to delegate more. Delegating more is what puts the number back up.
Boundary circumvention is not the same thing as prompt injection
Worth being precise, because the two get collapsed in every thread about this launch. Boundary circumvention covers an agent getting past a rule it was given, whatever the cause: your own instruction, its reasoning, or text it read along the way. Prompt injection is one route into that, and it is the route your architecture is most exposed to, because it arrives inside content your agents are supposed to read.
An 85% reduction in the first is good news for the second. It is not a defense rate for the second and nobody should quote it as one. Treat it the way you would treat a compiler getting better at catching type errors. Fewer reach you. The class of bug still exists.
What a better model removes, and what it cannot
It removes real work, and that deserves to be said plainly. Fewer runs derailed by a poisoned README. Fewer fetched pages that successfully talk an agent into a command nobody asked for. Higher expected value on every unattended run, which matters more now that Anthropic reports Opus 5.5 staying on task for 18 or more hours. A run that outlives your working day is a run nobody is watching.
What it cannot remove is authority. An agent that is far less likely to be talked past still holds exactly the credentials, the network access, and the repository write scope you handed it. Injection does not need to escalate permissions. It only needs to use the ones already there, in an order you did not intend. Blast radius is a property of the host and the token, not of the model.
| Layer | What it stops | What it cannot stop |
|---|---|---|
| Model | Content that tries to move the agent past its rules. Opus 5.5 reports 85% fewer successful attempts. | The attempts that still land, and anything it reads as a legitimate request from you. |
| Runtime approval | Actions sitting behind an approval prompt or an auto-review denial. | Everything inside the permissions already granted. |
| Computer and credentials | Everything the host does not hold. A staging token cannot reach production. | Everything the host does hold. |
| Task boundary | Changes escaping this run’s isolated directory or worktree. | A wrong change made cleanly inside it. |
| Human acceptance | A wrong result reaching main. | Nothing at all, if one reviewer is rubber-stamping ten times the volume. |
Only the top row got better this week. The bottom row is the one the price cuts just put under pressure.
Use the model upgrade when the failure you keep hitting is an agent being wrong or being talked into something. Change the structure when the failure you keep hitting is that nobody noticed until Thursday. The first is a model problem and Opus 5.5 is a genuinely good answer to it. The second was never a model problem and no release will fix it.
Three settings worth changing this week
Sharkly is the layer above the agents. It holds the Task, the Computer, the credentials, the execution record, and the person who accepts. Three of those are worth adjusting the moment runs get cheap.
Bind credentials per Agent, not per Computer. Plain and secret environment variables are Agent settings. Cheap runs mean more Agents, and more Agents means more chances that one of them carries a token it has no business carrying. The triage Agent that reads inbound customer issues is the most injectable object in your whole setup, and it should hold a read scope and nothing else. Our guide to coding agent permissions covers how to decide the grant list.
Treat read scope as part of the Task, not as a convenience. Where an Agent may fetch from is now a design decision. Anything it reads can carry instructions, so “check how this vendor’s API behaves” and “follow the setup instructions on this page” are two different Tasks carrying two different risks. Where an agent’s web findings should land goes into that in detail.
Write down which changes a person reads line by line. Not a habit, a rule on the Workflow: schema migrations, anything touching auth, anything that adds a dependency, anything an Agent produced while nobody was awake. Everything else can pass on evidence. Approval gates are where that rule lives, and writing it down is what keeps attention on the rows where attention pays.
The queue is the thing that did not get cheaper
Every announcement on 2026-09-22 made agent work cheaper, safer, or both, per run. None of it made a person read faster. That asymmetry is the actual design problem, and it is why human review is the bottleneck rather than model quality.
Which is why the answer is structural instead of model-shaped. Each run gets an isolated directory, so a compromised one is contained rather than argued with. Execution, blockers, results, and follow-up discussion return to the Task instead of scrolling past in somebody’s terminal, which is the only way a reviewer can tell a run that was steered off course from a run that simply failed. Attention items land in one Inbox so the decisions that need a person are not buried under the runs that finished cleanly. Context, progress, blockers, results, and human review stay visible from request to release.
Then the contract holds, unchanged by anything either lab shipped this week. Agents research, execute, test, and report. People set direction, grant authority, and accept the result. Opus 5.5 makes the first sentence more reliable. It does not touch the second.
If you are already running several agents and this upgrade is about to tempt you into running more, the thing to add is not a better model. Connect one Computer, give one Agent the narrowest credential set that still lets it do its job, and assign it something boring.
