Claude switched models on you because Anthropic shipped Claude Opus 5.5 on September 22, 2026, and it handles flagged messages differently from the models you are used to. Instead of refusing, Claude hands the conversation to Claude Opus 4.8, an older and less capable model, and keeps answering as that model for the rest of the chat. Anthropic calls the handover transparent, and it is: you get a notice, and the reply is labeled with the model that answered. The part that catches people is what happens next, because the model picker stays switched. I spent an afternoon in Anthropic’s documentation and in my own Claude settings, and the short version is that this is a deliberate feature, it is on by default, and one toggle turns it off.
Published September 25, 2026, three days after the Opus 5.5 launch. This is a documentation and settings read rather than a hands-on model test, and the body says which parts come from Anthropic and which come from users.
What it means when Claude switched models
Claude Opus 5 and Opus 5.5 run an automated safety classifier on every message you send. When that classifier flags your message, the request is not refused. It is handed to Claude Opus 4.8, and Opus 4.8 answers you instead.
That one mechanic explains a complaint I have been reading for months in the Claude refusal threads: a chat that was sharp for twenty minutes and then went noticeably duller, with no error and no explanation. There was an explanation. It sat in the model label, which almost nobody reads.
Anthropic’s help article is blunt about where you land. It calls the fallback “a less capable model.” That is not an insult to Opus 4.8, which was the flagship not long ago. It is simply not the model you picked, so when Claude switched models, the quality of your answers changed without you asking for it.
Why Anthropic built a downgrade instead of a refusal
Because a weaker answer beats no answer. Anthropic shipped Opus 5.5 with what it calls “extremely strong cyber capabilities,” strong enough that the model carries safeguards in the same family as Claude Fable 5.1’s. Rather than block that traffic outright, most of it goes to an older model that never had those capabilities in the first place.
The launch itself was a good one, which is what makes the trade-off interesting. Opus 5.5 costs $4 per million input tokens and $20 per million output, down from $5 and $25 on Opus 5, and it generates more than 30% faster. Anthropic ran its benchmarks with the safeguards switched on and says the routing “likely reduces Claude Opus 5.5’s performance on these benchmarks.” Vendors do not often mark down their own launch numbers.
So Claude switched models by design, not by accident. The fallback target, Claude Opus 4.8, now quietly handles most cybersecurity work at Anthropic, while routine bug fixing inside normal development stays with Opus 5.5.
The five flags that trigger a model switch
If Claude switched models on you, one of five flags is why. Anthropic publishes them as refusal categories in its developer documentation, and the same classifiers sit behind the consumer apps. Opus 5.5 added two of them: a biology classifier on top of the cybersecurity one Opus 5 already ran, and a category for requests that push the model to reproduce its own internal reasoning.
| Flag | What sets it off | Anthropic’s own caveat |
|---|---|---|
cyber |
Anything that could enable malware or exploit development | “Benign cybersecurity work can also trigger this category” |
bio |
Dangerous lab methods and biological harm (new on Opus 5.5) | “Beneficial life sciences work can also trigger this category” |
frontier_llm |
Work that could help build a competing AI model | “Benign machine learning work can also trigger this category” |
reasoning_extraction |
Asking Claude to reproduce its internal reasoning (new on Opus 5.5) | No benign caveat. Ask for thinking mode instead |
general_harms |
Usage-policy areas outside the four named ones | “Benign work can also trigger this category” |
Read that third column again, because it is Anthropic saying the quiet part in its own developer documentation. Four of the five categories ship with an explicit admission that legitimate work sets them off. If your ordinary security question or your biology homework got moved to another model, you did nothing wrong and you are not under suspicion. You matched a pattern.
One detail that only affects developers, but matters if you pay per token: on the API, a refusal that arrives before any output is billed when the category is bio, frontier_llm or reasoning_extraction. You can be charged for being told no. Anthropic’s stated reason is that those are the categories where it measures low false-positive rates, and it says the billed list will change as the safeguards improve.
The switch sticks, and that is what catches people
Once Claude switched models, it stays switched. Anthropic’s help article puts it plainly: “After the switch, the model picker stays on the less capable model for the rest of the conversation.” Later messages go straight to the fallback without being offered to Opus 5.5 at all.
“Why did Claude switch models?” is a question people tend to ask hours into a session rather than at the start. A single flagged sentence early on sets the model for everything that follows, including the forty messages afterward that had nothing to do with whatever tripped the flag. You can switch back from the model picker whenever you want, but you have to notice first, and the notice arrives once, on one reply, in a conversation you are probably scrolling past. By the time you work out that Claude switched models, you can be thirty replies past the message that caused it.
It gets one step stranger. The classifier reads the conversation, not only your newest message, so context you pasted in earlier can keep setting off a flag on turns that look completely innocent by themselves. That is the same effect behind the fix in my refusal guide, where splitting one long prompt into smaller ones clears a block that made no sense as a whole.
The setting most people don’t know they have
If Claude switched models and you would rather it didn’t, there is a toggle. In the Claude apps it lives under Settings > Capabilities, named “Switch models when a message is flagged.” In Claude Code the same control sits under /config, in the MODEL & OUTPUT section.
It turns itself on the first time you select Opus 5 or Opus 5.5, which is why almost nobody remembers agreeing to it. I checked mine before writing this and it was on, exactly as documented. Before you flip it, understand the trade you are making. The setting describes itself as “when safeguards flag a message, automatically switch to a different model to keep chatting,” and tells you what the alternative is: “when off, your chat will pause instead.” So leave it on and a flagged message gets answered by a weaker model. Turn it off and the conversation stops there. Neither one gives you Opus 5.5 on the flagged request, so the real question is which failure you would rather deal with. I left mine on, because a model label is easier to spot than a refusal is to argue with.
The automatic switching runs across Claude on web, mobile, desktop, Cowork, Code, Design, Microsoft 365, Tag and Science. API customers are the exception, where it is opt-in.
Eight cameras, a home network, and seven stopped replies
The clearest public false positive I found was filed on September 18 by someone building a home security camera system. Eight cameras on their own private network, recording to their own Mac, with their own credentials. No scanning, no break-in attempt, nothing touching anyone else’s hardware.
The cyber classifier stopped their work seven or more times across three sessions. Opus 5 and Fable 5.1 both did it. Opus 4.8 completed the identical task without a single stop, which is exactly what you would expect given which model this traffic gets routed to.
The line from that bug report that stuck with me:
“A brand-new session was stopped the moment it read the earlier session’s transcript to recover context, with no device access attempted.”
A fresh chat, flagged for reading its own notes. That is the conversation-history effect in one sentence, and it is the best argument I have seen for keeping flagged material in a different chat from your actual work, whether Claude switched models on you or stopped the turn outright.
Switch, refusal, outage or usage limit: how to tell
Four different problems produce four different symptoms, and people mix them up constantly. A reply that arrives after Claude switched models carries a different model label, and nothing is actually broken. A refusal is a written no. An outage is errors or silence. A usage limit is a countdown.
- Switched: the reply is labeled with another model. Check the model picker and switch back.
- Refused: Claude explains why it won’t answer. Rework the wording, which works more often than people expect.
- Broken: errors, spinning, or half-finished replies. Start with the fixes in Claude not working.
- Limited: you are told when you can continue. That is usage limits, not safety, and no setting changes it.
Telling them apart saves real time. I have watched people clear cookies and reinstall an app for an hour over what was one click back in the model picker.
What I’d check before your next long Claude session
Three things, and none of them takes a minute. Open Settings > Capabilities and decide deliberately whether you want the switching on, instead of finding out mid-project. When a long chat starts feeling shallower than it did an hour ago, read the model label on the last reply before you blame your own prompt. And if you work in security, life sciences or machine learning, keep flagged research in its own conversation so one early flag doesn’t follow you all week.
Now that you know why Claude switched models, the fix is one click, but the pattern behind it is worth watching. Anthropic has moved from refusing you to rerouting you, which is friendlier on the surface and much harder to notice. Claude Sonnet 5.5 has since shipped, with Haiku 5.5 still to come, and the question I keep asking as they land is whether the same silent handoff follows them down the price list. For the background on why every chatbot does some version of this, I wrote the long version in why AI chatbots refuse.
