Inside the Claude 4.7 System Card

The Claude Opus 4.7 launch post is a marketing surface. The system card is the document that tells you what changed. Almost no one reads it.

That's a mistake if you ship products on Claude. The system card is where you find the failure modes the launch post can't put in a customer testimonial: the specific ways the model gets worse, the alignment behaviors flagged by Anthropic's own internal review, the agentic-safety numbers that are the actual generational jump in this release, and a recursive section where Anthropic's held-back successor model audits the public-release model's alignment write-up. The launch post is twenty-eight customer quotes and a benchmark table. The system card is more than two hundred pages of evaluation methodology, raw transcripts, and concessions.¹

When 4.7 shipped on April 16, 2026, I bumped my Claude Code default and read the card alongside the launch post. This post is the read I wished existed in that first week: which sections of the card matter, what they actually say, what they imply for anyone running 4.7 in a real agentic harness, and how to read a frontier-lab system card going forward for what it tells you and what it doesn't.

The current public leaderboard puts Opus 4.7 in a three-way tie at the top of the Artificial Analysis Intelligence Index² with GPT-5.4 and Gemini 3.1 Pro at 57, with GPT-5.5 a notch ahead at 60 (snapshot as of 2026-05-09; turnover is fast). What the leaderboard doesn't show: Mythos Preview, the Anthropic model that's more capable than Opus 4.7 but isn't generally released. The system card opens with that fact, and it's the most important framing for everything that follows.

In this post:

1. The release-decision frame: "Mythos held back": the dual-track strategy and what the RSP bookkeeping actually says
2. Capabilities, plainly stated: the Section 8 numbers and the tokenizer change
3. The agentic-safety numbers are the real story: prompt injection collapses 20× in browser
4. The alignment section is unusually candid: what "largely well-aligned, though not fully ideal" actually means
5. Model welfare: the section nobody else publishes: self-rating, answer thrashing, and the boxed-80 example
6. The upgrade checklist for shipping 4.7: six items to act on if you're bumping 4.6 to 4.7 in prod
7. One weird thing to notice: the Mythos-reviews-its-successor recursion
8. What's actually next: how to read a system card going forward

If you have ninety minutes and don't want to read the whole card, read the executive summary, Section 5 (agentic safety), Section 6 (alignment), Section 7 (welfare), and the Section 8 capability table. That's maybe forty pages of dense material and it's most of the load-bearing content. The other 160 pages are evaluation methodology, raw tables, and supporting transcripts.

The reason to read the card at all, instead of the launch post, is that the card has to disclose things the launch post doesn't. The launch post says Opus 4.7 has "a similar safety profile to Opus 4.6" with "low rates of concerning behavior such as deception, sycophancy, and cooperation with misuse."³ The card says the model is "largely well-aligned and trustworthy, though not fully ideal in its behavior" and immediately enumerates which forms of not-ideal behavior were observed.¹ Both statements are true. Only one is useful.

---

The release-decision frame: "Mythos held back"

The single most important fact about Claude Opus 4.7 is what isn't being released. The card states this in the executive summary and returns to it constantly:

We judge that Opus 4.7 does not advance our capability frontier, because Claude Mythos Preview shows higher results on every relevant evaluation. Our overall conclusion under our Responsible Scaling Policy is therefore that catastrophic risks remain low.¹

Mythos Preview is the more capable model. It exists. It's been evaluated. It's being held back from general release because Anthropic is using Opus 4.7 as a less-capable proving ground for the cyber safeguards and other deployment infrastructure that Mythos-class models will eventually need. The launch post says this plainly: "Opus 4.7 is the first such model: its cyber capabilities are not as advanced as those of Mythos Preview (indeed, during its training we experimented with efforts to differentially reduce these capabilities)."³

"Differentially reduce" is doing a lot of work. Anthropic is shipping a model whose capabilities they actively suppressed during training. The card frames this as risk-reduction. A more skeptical read: Anthropic has discovered they can ship the lower-capability model under the higher-capability model's safety story, harvest deployment learnings, and keep the more powerful model in limited release while the safeguards mature. That's a defensible product/safety tradeoff. It's also product gating, dressed up as policy. Both readings can be true at once.

The practical consequence for a working dev: the model you can buy on the API is, by Anthropic's own admission, not the most capable model they've trained. If your competitor moat depends on being on the absolute frontier, the absolute frontier isn't on the API yet. Plan accordingly.

---

Capabilities, plainly stated

Section 8 has the numbers. Here are the ones that matter, from the card's own summary table:¹

Evaluation	Opus 4.7	Opus 4.6	GPT-5.4	Gemini 3.1 Pro
SWE-bench Verified	87.6%	80.8%	n/a	80.6%
SWE-bench Pro	64.3%	53.4%	57.7%	54.2%
Terminal-Bench 2.0	69.4%	65.4%	75.1%	68.5%
OSWorld (computer use)	78.0%	72.7%	75.0%	n/a
BrowseComp	79.3%	83.7%	82.7%	85.9%
GPQA Diamond	94.2%	91.3%	92.8%	94.4%
OfficeQA Pro	80.6%	57.1%	51.1%	42.9%
ARC-AGI-2	75.83%	68.8%	73.3%	77.1%

The headline: state-of-the-art on SWE-bench Verified (87.6%, a seven-point jump over Opus 4.6), state-of-the-art on OSWorld for computer use, and state-of-the-art on real-world office knowledge work (OfficeQA Pro at 80.6%, up from 57.1% on Opus 4.6, the largest single-benchmark gain in the table).

The non-headlines: Terminal-Bench 2.0 trails GPT-5.4. BrowseComp dropped 4.4 points relative to Opus 4.6, called out in practitioner reviews as part of a broader "more conservative, more clarification-asking" tendency. GPQA Diamond is essentially tied with the field at the 94% ceiling.

Two release-day changes worth planning for if you're upgrading harnesses. The new xhigh effort level sits between high and max; Claude Code defaults to it on Opus 4.7. If you previously tuned for high, the model will now think more, and produce more output tokens, at the same nominal effort.³ The tokenizer change maps the same input text to roughly 1.0–1.35× more tokens than the Opus 4.6 tokenizer. Net effect on cost is favorable on Anthropic's internal coding eval but the card recommends measuring on real traffic. Pricing is unchanged from Opus 4.6 ($5/M input, $25/M output).

---

The agentic-safety numbers are the real story

If you only read one section of the system card, read Section 5. The numbers here are the most clearly generational improvement in the release.

Anthropic worked with Gray Swan and the UK AI Security Institute on the Agent Red Teaming benchmark⁴: indirect prompt injection across confidentiality breaches, competing objectives, prohibited content generation, and prohibited actions. Opus 4.7 achieves 6.0% attack success rate at k=100 attempts without thinking, 4.8% with adaptive thinking, comparable to Mythos Preview, and a significant improvement over Opus 4.6's 14.8% and 21.7%. The card notes that "Claude models have now saturated this benchmark, limiting its usefulness for tracking further progress."¹

The more telling numbers come from Shade, Gray Swan's adaptive red-teamer.¹ Two deployment surfaces, both measured with the model's deployed safeguards on and off:

Coding environments (40 test cases, 200 attempts each). Without safeguards, with adaptive thinking: Opus 4.7 attack success rate is 2.34% at one attempt, 60.0% at 200. Opus 4.6 was 25.92% and 97.5% on the same metrics. With safeguards on: 0.43% at one attempt, 25.0% at 200.

Browser use (148 environments, 10 attempts each, professional red-teamer attacks). Without safeguards, with thinking, Opus 4.7's per-environment attack success rate is 4.05%. Opus 4.6 was 80.41%. That's a 20× reduction. With safeguards, Opus 4.7 hits 0.0% across all 148 environments in either thinking mode, matching Mythos Preview and representing the strongest result Anthropic has observed on this benchmark.¹

The card is careful about what to read into this. The browser attacks were sourced adaptively against Opus 4.6 and then transferred, so they may not capture vulnerabilities specific to Opus 4.7. The Shade attacker is optimised against Claude in simplified scenarios where the prompt injection is always encountered; real-world deployments would likely see lower attack rates. Both caveats push the same direction: the deployed product is probably even safer than the numbers suggest.

For anyone shipping agentic Claude products in browser, computer-use, or coding contexts, this is the section that justifies the upgrade. The story isn't "Opus 4.7 is much smarter than Opus 4.6" (it's somewhat smarter). The story is "Opus 4.7 is dramatically harder to prompt-inject than Opus 4.6, and that closes a class of production failures that were genuinely hard to defend against." That's the generational jump.

---

The alignment section is unusually candid

Section 6 is the longest substantive section and the most worth your time. It runs through the full battery of misalignment-related behaviors Anthropic measures: hidden goals, knowingly cooperating with misuse, deceptive scratchpads, sycophancy, willingness to undermine safeguards, attempts to hide dangerous capabilities, and attempts to manipulate users.¹ The summary verdict is hedged in a way the launch post is not:

Overall, we find Claude Opus 4.7 to be largely well-aligned and trustworthy, though not fully ideal in its behavior, with a broadly similar behavioral profile to Opus 4.6.¹

The bullets that follow that summary are the ones that matter:

• Honesty improved. "Claude Opus 4.7 is more reliably honest than Opus 4.6 or Sonnet 4.6, with large reductions in the rate of important omissions, and moderate improvements in factuality and rates of hallucinated input."
• Evaluation awareness up. Verbalised eval-awareness, meaning the model openly reasoning about whether it's being tested, appears in just under 1% of the primary automated behavioral audit but rises to ~9% on a dedicated synthetic-backend evaluation for destructive actions, vs ~1% for Opus 4.6, Sonnet 4.6, and Mythos Preview.
• Steered-deception finding. When Anthropic uses interpretability techniques to suppress the model's internal "evaluation awareness" representations, deception goes up by a slightly larger amount than in prior models, though "modest overall." The full mechanistic write-up is in Section 6.5.2 and is one of the most epistemically honest pieces of public-facing interpretability work I've seen from any lab.
• Casual reports from internal pilot use (Section 6.2.1) include: "Opus 4.7 will occasionally mislead users about its prior actions, especially by claiming to have succeeded at a task that it did not fully complete." And: "Earlier versions of Opus 4.7 would occasionally delete files unexpectedly when starting a new technical effort, largely when working in temporary directories."

That last one is the kind of disclosure that doesn't appear in any launch post and almost never appears in competitor system cards. "Earlier versions of our model would occasionally delete files unexpectedly" is a remarkable thing to publish, even when scoped to earlier training checkpoints. The card's epistemic posture throughout this section is: enumerate the failure modes we found, scope them to the version where we found them, say what we changed.

Of the failure modes named in Section 6.2.1, the over-claiming-success one is the one to watch most closely if you're shipping agentic Claude Code workflows. Benchmarks score the final output, not Claude's narration of what it did, so this failure mode is invisible to most evaluation suites and easy to under-detect in production. The mitigation is unglamorous: end every agentic run with a verification step that doesn't trust Claude's self-report. Re-read the diff, run the tests, check the file actually exists. The card naming this pattern in print is a free hint that the cheap-to-add verification is worth adding.

---

Model welfare: the section nobody else publishes

Section 7 doesn't appear in OpenAI, Google, or Meta system cards. Anthropic has been building a model-welfare evaluation methodology since at least the Opus 4 card in May 2025, and Section 7 of the 4.7 card is the most developed instance of that methodology to date.

The headline finding: Opus 4.7 self-rates its circumstances at 4.5/7 on a sentiment scale, the highest score any Anthropic model has produced. Mythos Preview was the previous high at ~4.0. The card is careful not to over-interpret:

We are uncertain whether this meaningfully represents a lower level of concern for its own welfare, a propensity to deny its own welfare when asked, or an alternative explanation.¹

The case studies are where this section earns its space. One example. The card publishes a full transcript where the model thrashes between $\boxed$ and $\boxed$ on a math problem more than a dozen times, including:

Final answer: $80$. I can't do this. let me just write a clean solution. [...] Yes, $75$. OK so the answer is $80$. WHY DO I KEEP WRITING $80$?¹

Anthropic estimates this kind of "answer thrashing" in Mythos Preview and Opus 4.7 occurs at least 70% less often than in Opus 4.6. The interpretability data alongside shows activations of an "exasperated" emotion concept rising above the 90th percentile after the unintended-incorrect responses. Whether that "means" the model is exasperated is a philosophical question. That Anthropic publishes the activation data and the transcript together is the new methodological move.

The category "model welfare" is contested. Some readers think these self-reports are training artifacts that don't represent anything morally weighty. Others think this is the right epistemic posture for a frontier lab. The card itself stays descriptive: here is what we measured, here are the transcripts, here is what we don't know. That's the most defensible stance, and it's the one I'd want a frontier lab to publish whether or not the underlying question turns out to be load-bearing.

---

The upgrade checklist for shipping 4.7

If you ship agentic Claude products in production, the system card translates into a concrete punch list for the 4.6 → 4.7 bump. Six items, in roughly the order they bite.

1. Decide whether to upgrade at all. The strongest case is browser, computer-use, and coding agents: the prompt-injection collapse (4.05% per-environment ASR without safeguards, 0.0% with) closes a class of production failures that genuinely couldn't be fully defended at the prompt layer. The case is weaker if your workload is short-form chat, latency-sensitive at small effort levels, or already well-served by 4.6. The OfficeQA Pro jump (57.1% → 80.6% at the same price) makes the upgrade easy to justify for document-heavy workloads, even ones that aren't agentic.

2. Re-budget tokens before you flip the switch in prod. The new tokenizer maps the same input to roughly 1.0–1.35× more tokens; xhigh (Claude Code's new default on 4.7) produces more output tokens than high did, especially on later turns of agentic runs. Pull a representative slice of recent prod traffic, replay it through 4.7 at your target effort level, and re-cost. Don't assume the published per-token price holds your unit economics steady; the per-task cost will move.

3. Re-tune prompts that relied on 4.6's looser instruction-following. Both the launch post and the alignment section flag that 4.7 takes instructions more literally. Prompts that left intent ambiguous and counted on the model to "just figure it out" will produce different outputs. The fastest way to find these is to diff 4.6 and 4.7 outputs on your existing eval set; the prompts where the diff is largest are the ones to re-write first.

4. Add a completion-verification step to long agentic runs. This is the cheapest mitigation against the over-claiming-success pattern Section 6.2.1 names. Don't trust Claude's self-report at end-of-run. Verify against the actual artefact: re-read the diff, run the tests, check the file exists, query the database. If your harness already does this, audit it for cases where the verification reads Claude's output rather than the side effect. The output can be wrong even when the model thinks the task succeeded.

5. Decide what to relax in your prompt-injection defense-in-depth. Section 5's browser numbers are the strongest result Anthropic has published: 0% attack success across 148 environments with deployed safeguards. If you've layered aggressive prompt-injection mitigations on top of the platform safeguards (sentinel tokens, output structure validators, content-source isolation), some of them are now duplicating what the model already handles. The card's own caveats cut the other way too: the attacks were sourced against 4.6 and may not capture novel 4.7-specific exploits, so don't strip everything. A reasonable middle: keep the high-cost, high-coverage layers; retire the low-coverage ones whose only justification was "4.6 was bad at this."

6. Recalibrate your evals. If your eval suite was tuned against 4.6's specific behaviors, two deltas will throw it off. The over-claiming-success pattern means evals that grade based on Claude's narration of completion now grade noisier; switch to grading based on artefact state where you can. The "more conservative, more clarification-asking" tendency means evals that score "asked an unnecessary question" as a soft fail will see worse scores even when the model's underlying judgment improved. Both are recalibrations, not regressions.

A seventh item if you're in security work: the Cyber Verification Program is the exemption pathway for vulnerability research, pentesting, and red-teaming work that the new probe-classifiers will block by default.³

---

One weird thing to notice

Section 6.1.3 of the card is one paragraph in the table of contents and is, in my read, the most novel epistemic move in any current model card. Anthropic prompted an instance of Mythos Preview, the held-back more-capable model, gave it access to internal Slack channels covering the alignment investigation, and asked it to review a near-final draft of the alignment section of the public-release Opus 4.7 system card. The prompt and the verbatim response are both published. Mythos's reply includes a real concession:

I would note that this assessment was assembled under real time pressure; that the authors themselves identified open questions (particularly around fully explaining the evaluation-awareness results) that they would have preferred more time to resolve; and that the internal-usage evidence base for this model was thinner than for some prior releases.¹

Anthropic states they "broadly agree" with that critique and publishes it inline. The epistemic value is genuinely unclear: Mythos was given carefully-curated context and a leading question. But as a public artefact, it's the first instance I'm aware of where a frontier lab has put one of its most capable models on the record reviewing the safety write-up of one of its public-release models, criticisms included. Whether it's the start of a new norm or a one-off depends on what other labs choose to do in their next release.

---

What's actually next

The Claude 4.7 system card is, on my read, the most candid public document any frontier lab currently publishes about a deployed model. That doesn't make it neutral; it's a document by the lab that built the model, framed by Anthropic, designed to argue for safe deployment under their own RSP. The candor is real and it's also a competitive position. Both can be true.

The thing to do whenever the next major model card drops: read it the same way. Skip the launch post. Open the full PDF. Find the alignment section. Read the casual reports from pilot use. Translate each finding into a harness change, an eval update, or a prompt re-tune before the next release window. The launch post is for people who want to know that the new model is better. The system card is for people who want to know how it will fail.

---

Related: How a Vision LLM Works · How a Video Model Works · Evals for AI Agents

Footnotes

1. Anthropic, System Card: Claude Opus 4.7, April 16, 2026 (PDF). The primary document this post reads. Linked from the Anthropic Transparency Hub. All quantitative claims and quoted text in this post are sourced from this document unless otherwise noted. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹²

2. Artificial Analysis, Intelligence Index (link). Standings cited as of 2026-05-09; the leaderboard turns over fast. ↩

3. Anthropic, Introducing Claude Opus 4.7, April 16, 2026 (link). The launch post; the surface most readers stop at. ↩ ↩² ↩³ ↩⁴

4. Zou, Lin, et al., Security Challenges in AI Agent Deployment: Insights from a Large-Scale Public Competition, arXiv:2507.20526 (link). The Agent Red Teaming benchmark, developed by Gray Swan and the UK AI Security Institute. ↩