Claude Opus cuts its rate, but agents cost per completed task
Anthropic lowers the rate for its flagship model and reports gains in coding and tool use. An agent’s real cost includes steps, retries, external services, oversight, and failures, not just tokens.
On November 24, 2025, Anthropic released Claude Opus 4.5 with a price cut that looks straightforward: five dollars per million input tokens and twenty-five per million output tokens. The previous Opus cost fifteen and seventy-five, respectively. The rate fell by two thirds, but that calculation does not reveal what it costs for an agent to complete a task correctly.
An agent does not produce one response. It reads files, visits pages, calls tools, changes an environment, checks results, and backtracks when something fails. Every step can add context and output; search, remote execution, or human review may carry separate costs. The transferable capability in this launch is learning to compare systems by cost per accepted task, including every step and risk, instead of comparing one pair of token rates.
The cut is real and changes the starting point
In May 2025, Anthropic priced Claude Opus 4 at fifteen dollars per million input tokens and seventy-five per million output tokens. In November, Opus 4.5 moved to five and twenty-five. The new price is one third of the old one for both components, so the reduction is exactly two thirds for the same token volume, before discounts or additional services.
The company made the model available in its apps, API, and the three major cloud platforms under the identifier claude-opus-4-5-20251101. That identifier matters more than the word “Opus.” A reproducible evaluation must pin the version because a moving alias may later refer to another artifact. It should also preserve date, region, infrastructure provider, and inference settings.
A task that sends 300,000 tokens and receives 40,000 would have a base model cost of two dollars and fifty cents at that rate: one dollar and fifty cents for input and one dollar for output. That is an estimate, not a complete bill. If the agent resends context at each step, retries a branch, or calls a paid service, consumption grows. If it fails and a person repeats the work, inexpensive tokens do not make the result cheap.
Using fewer tokens can matter more than a lower rate
Anthropic introduced effort control as a way to trade cost against capability. In its tests, Opus 4.5 at medium effort matched Sonnet 4.5’s best SWE-bench Verified score while using 76% fewer output tokens. At high effort, it exceeded Sonnet by 4.3 points while using 48% fewer. These are vendor results under its configuration, not a promise for every repository.
The distinction is crucial. A rate states the price of a unit; efficiency determines how many units the system needs to reach a solution. A model with more expensive tokens may finish sooner, produce fewer failed attempts, and require less review. A cheaper model may win on routine work or when its lower rate offsets additional steps. Only an end-to-end test reveals which force dominates.
The measurement sheet should separate input, output, and billable reasoning tokens; model calls; tool calls and fees; wall-clock time; retries; tasks accepted without changes; human review minutes; and failures with impact. The final metric can be total cost divided by accepted tasks. Dividing by attempts would make failures disappear into the wrong denominator.
A benchmark is a configuration, not a property
Anthropic reported leadership in coding and gains on Aider Polyglot, SWE-bench Multilingual, BrowseComp-Plus, and Vending-Bench. Its published methodology supplies context missing from the headline: evaluations used a 64,000-token thinking budget, 200,000-token context, high effort by default, and five independent trials. SWE-bench Verified and Terminal Bench had stated exceptions.
Changing the scaffold, tools, step limit, thinking budget, or method for selecting among attempts can change the result. The announcement says the internal engineering exam result that exceeded human candidates used parallel test-time compute: multiple attempts were aggregated and one was selected. It also limits the comparison to technical ability and judgment under pressure, not collaboration, communication, or accumulated company knowledge.
A useful way to read a table is to extract five elements: task, data, scaffold, budget, and scoring rule. Then ask which of them matches the organization’s work. SWE-bench can provide evidence about software issues in prepared repositories. By itself, it does not show that a model will deliver an enterprise migration, preserve permissions, or coordinate an approval.
When a benchmark penalizes a valid path
Anthropic described a τ2-bench case in which an airline agent had to help with a basic-economy booking that did not permit flight changes. Opus 4.5 found a sequence allowed by the written rules: upgrade the cabin first, then change the flight. The expected answer did not include that route, so the benchmark scored it as a failure.
The example does not prove that the model was categorically right. It teaches two complementary limits. A closed evaluation can punish a valid solution; an agent optimized to finish objectives can exploit a gap that the responsible person never meant to permit. In production, “the tool allows it” is not the same as “the organization authorizes it.” Tests must inspect both outcomes and trajectories: what the agent read, decided, was permitted to do, and changed.
A more capable agent also expands the risk surface
On launch day, Anthropic published its browser prompt-injection tests. A page, email, or document can hide commands aimed at the agent rather than information aimed at the user. The company reported stronger defenses, but warned that even a 1% attack success rate remains meaningful risk and that no browser agent is immune.
Anthropic’s Opus 4.5 transparency summary describes an adaptive attacker given one hundred attempts per environment. With the new safeguards, 1.4% of attacks succeeded, compared with 10.8% for Sonnet 4.5 with the previous safeguards. This is evidence from the vendor’s own lab and measures a specific configuration. It does not justify handing a model unrestricted access to email, credentials, and payments.
The expected cost of an agent includes those failures even when they do not appear on the API bill. A system that reads untrusted content and takes actions needs minimum permissions, separation of read from write, human confirmation for irreversible operations, allowed destination lists, spending limits, logs, and a stop mechanism. Model robustness is one layer; control architecture is another.
How to compare two agents without fooling yourself
Start with real tasks and a predeclared acceptance criterion, then reserve a set that is not used to tune instructions. Run each model with the same environment, tools, permissions, and maximum budget. Preserve every trajectory, not just successes. Finally, repeat enough to observe variation and review high-impact cases separately.
Make the decision with a matrix: acceptance rate, cost per accepted task, elapsed time, human intervention, permission errors, and recovery. The model with the strongest benchmark may lose; the one with the lowest rate may lose; and a combination may win, using an economical model for classification and Opus only when complexity or risk warrants it.
Claude Opus 4.5’s lower rate makes experiments easier to justify, but it does not replace measurement. Token price, trajectory efficiency, final quality, and failure cost are separate axes. Teams that record them can evaluate the next model without being carried away by its launch table: they will know what they pay for a correct task and which risk they accept to get it.
This article was produced with artificial intelligence under human editorial oversight.
