Claude Sonnet 4.5 profile

    Claude Sonnet 4.5 — security & risk dashboard

    Known weaknesses, safety and security advisories, and documented real-world incidents for Claude Sonnet 4.5 — collected automatically and re-checked every few hours, so teams building on it can see what to design around.

    Last checked 23 Oct 2026

    Ask the Advisor about this model
    Known flaws

    5

    Security risks

    4

    Real-world incidents

    0

    Advisories logged

    0

    Security, safety & abuse risks

    • Instructions hidden in websites, documents or tool results can redirect an agent or induce disclosure of sensitive information.
    • Coding and tool-use capabilities can be repurposed for reconnaissance, exploitation and data theft.
    • Broad filesystem, network or account permissions can turn model mistakes into unauthorized changes or data exposure.
    • Confident but incorrect reports can mislead operators about whether an action succeeded or what information was obtained.

    Known flaws & limitations

    • Can generate incorrect facts, faulty reasoning and defective code, including plausible but unsupported conclusions.
    • Computer-use and tool workflows can fail or require human intervention.
    • Improved prompt-injection resistance does not eliminate susceptibility to malicious external instructions.
    • The 1M-token context window is an extended-context option rather than the standard window.
    • The listed prices are standard USD rates per million input and output tokens; long-context requests and additional services can cost more.

    Security advisories & risk updates

    No risk advisories logged since this profile started being tracked. New ones appear here automatically.

    What this means if you are building on it

    • Unsupervised high-stakes decisions requiring consistently correct factual judgments.
    • Autonomous execution with unrestricted production credentials or destructive permissions.
    • Security-sensitive workflows that treat external content as trusted instructions.

    Everything here comes from published documentation, advisories and reporting, with links to the original sources. It is not a complete vulnerability database — always check the provider's own security notices before shipping.