Anthropic shipped Claude Opus 5 on July 24, 2026. If you build SaaS and use AI to code, three things actually matter: the reasoning effort control, the 1 million token window, and the detail almost nobody mentions, which is that the model is strong at code but lags at security.
Let's get to what changes in practice.
The effort toggle changes your cost per task
Opus 5 gives you a control to pick how much effort the model spends: low, medium, or high. There's also a new reasoning mode called xhigh for when you need the ceiling.
This is not decoration. It's a knob that moves your cost and your latency directly. Pricing stays the same as Opus 4.8: US$5 per million input tokens, US$25 per million output. What changes is how many reasoning tokens the model burns before it answers. High effort thinks more, spends more output, takes longer. Low effort cuts that.
For day-to-day SaaS coding, the rule is simple:
- Low effort for dumb tasks. Renaming a variable, writing a trivial test, formatting JSON, generating repetitive CRUD, tweaking copy. No deep reasoning needed. Low delivers the same result cheaper.
- High or
xhighfor decisions that hurt when wrong. Modeling a payment flow, reviewing a schema migration, designing a state machine, chasing a concurrency bug. Here the extra reasoning pays for itself.
The common mistake is leaving everything on max out of laziness. You pay for expensive output on tasks that didn't need it, and you wait longer for the answer. The other mistake is leaving everything on min and getting a shallow solution on a sensitive flow. The toggle exists so you choose per task, not once.
Practical tip: treat effort as a parameter of your pipeline, not a manual click. If you call the API by task category (lint, test, feature, critical-flow refactor), bind the effort level to the category. Cost stays predictable and you don't rely on remembering.
1 million tokens of context and what it unlocks
The window is now 1 million tokens. For SaaS, that means putting real context in the prompt instead of chopping everything into tiny pieces.
Cases that get better:
- Reviewing a whole module with its tests, types, and call sites together, instead of file by file and losing the big picture.
- Passing a large PR's full diff along with the related files for a review that sees the flow, not just the line.
- Giving the model the schema, the migrations, and the repositories at once so it reasons about a data change without hallucinating the contract.
But a big window is no excuse to dump the whole repo in the prompt. Two traps:
- Cost. 1M input tokens at US$5 per million is real money on every call. Big context is a tool, not a default. Put what's relevant to the task, not everything that exists.
- Noise. The more irrelevant junk you push, the easier it is for the model to drift from what matters. Curated context beats big context.
The right read: you got room to give the full context of a flow, and now you can run reviews that actually cross files. Use it for quality, not for filler.
Strong at code is not strong at security
Here's the part we at RET make a point of shouting.
Opus 5 is state of the art on code and knowledge-work evals like Frontier-Bench and GDPval-AA. It's Anthropic's best model for coding. And even so, it sits behind Claude Mythos 5 on cybersecurity tasks.
Read that again. The strongest model for writing code is not the strongest for finding and understanding security flaws. Those are two different skills, and Anthropic has different models leading each one.
What that means for your SaaS:
- Opus 5 will generate code that compiles, passes the test, and looks clean. That does not mean it's secure. Pretty code with a built-in IDOR is still an IDOR.
- Letting the same model write and "security-review" its own code is a blind spot. It optimizes for working, not for resisting attack.
- Security review stays a separate job with its own focus: authZ on the right route, input parsed and not just validated, secrets that don't leak, injection, sensitive data in logs or responses.
This isn't anti-AI. It's using the right tool for each thing. You use high effort to code the flow, and you keep a dedicated security review step on top of the output, whether with a specialized model, with process and a human checklist, or with an analysis tool. The point: don't confuse "passed the test" with "is secure".
Anthropic's pace and what to do with it
Opus 5 is Anthropic's fourth model in under two months. Mythos 5, Fable 5, and Sonnet 5 came in June, and now Opus 5. It's already the default on Claude Max and the strongest on Claude Pro.
That pace has a practical consequence: don't tie your architecture to a single model. If you call the API by task category and keep the effort level as a parameter, swapping models becomes a config change, not a rewrite. The market will keep shipping fast, and whoever has a decoupled pipeline swaps without pain.
Quick checklist to adopt Opus 5
- Map your AI calls by task category.
- Bind the effort level to the category: low for trivial, high or
xhighfor critical flows. - Use the 1M window to give full context of a flow, not to dump the repo.
- Treat big context as cost, and curate what enters the prompt.
- Keep security review as a separate step, always. Code that works is not secure code.
Opus 5 coding better doesn't hand you security for free. Pick effort per task, curate context, and review security separately.
