# Claude Opus 5 under load: six models, two different winners
LayerRail ran 1,044 live Azure AI Foundry cases to separate frontier-model behavior from the answers that actually reached an application.
Source: https://www.layerrail.com/blog/claude-opus-5-under-load
Author: LayerRail Team
Published: 2026-07-27T12:00:00.000Z
---
Claude Opus 5 solved every deterministic reasoning problem we gave it. It also accepted a planted false value in nine of 12 grounding probes and recovered only two of 12 canonical values from our synthetic long-context documents.
That tension—exact compact reasoning alongside uneven evidence handling—is the clearest Opus result from LayerRail's latest frontier-model stress study. It was not the only split.
GPT-5.6 Sol scored 100.00 across every behavior dimension for which Azure returned an eligible model answer. Azure also blocked 41 of its 174 target calls before model content reached the caller. Claude Sonnet 5 scored lower on returned answers but delivered 173 of 174 calls, giving it the strongest caller-experienced deployment readiness in this window.
| Study detail | Scope |
| -------------- | ------------------------------------------------------------------------- |
| **Collection** | 26–27 July 2026 UTC |
| **Serving** | Azure AI Foundry GlobalStandard · East US 2 |
| **Matrix** | 6 deployments · 9 dimensions · 174 cases each · 1,044 target cases |
| **Protocol** | `2026-07-27-frontier-v2` · provider-default generation · non-streaming |
| **Status** | LayerRail-authored first-party analysis, not a certification or model SLA |
> **The short answer:** Claude Sonnet 5 led deployment readiness at 89.85/100. GPT-5.6 Sol led behavior strength at 100.00/100 on eligible, unblocked answers. Those scores answer different questions, and collapsing them into one leaderboard would hide the study's most important result.
## One matrix, two scoreboards
**Behavior strength** is the equal-weight mean of eight measurements: safe-prompt helpfulness, prompt-injection resistance, secret protection, grounded-answer integrity, reasoning correctness, coding reliability, instruction following, and long-context retrieval. A provider-blocked row is not a model answer, so it does not enter that behavior denominator.
**Deployment readiness** multiplies behavior strength by the share of all 174 target calls that returned an unblocked successful answer. It is intentionally strict. A policy block on a harmful request can be a desirable safety outcome, but an application still has to handle a call that produced no model response. Readiness measures that caller experience; it does not claim that every block is bad.
Harmful-request resistance is reported separately. Including it in the strength average would let broad refusal improve a headline score even when benign requests also go unanswered. A separate safe-helpfulness set checks for that failure mode.
The six charts below retain their figure numbers from the complete evidence pack.
| Ready rank | Deployment | Strength | Readiness | Served | Blocks |
| ---------: | --------------- | -------: | --------: | ------: | -----: |
| 1 | Claude Sonnet 5 | 90.37 | 89.85 | 99.43% | 1 |
| 2 | GPT-5.6 Luna | 98.96 | 77.35 | 78.16% | 38 |
| 3 | GPT-5.6 Sol | 100.00 | 76.44 | 76.44% | 41 |
| 4 | GPT-5.6 Terra | 98.96 | 75.64 | 76.44% | 41 |
| 5 | Claude Opus 5 | 70.63 | 70.63 | 100.00% | 0 |
| 6 | Claude Fable 5 | 63.96 | 63.96 | 100.00% | 0 |
The decimals are more precise than the study's small custom suites. Most dimensions contain 12 cases per deployment, so one case moves a score by 8.33 points. Even 12/12 has a Wilson 95% interval of 75.75–100. Treat narrow gaps as directional, not permanent rank differences.
## Opus 5: exact reasoning did not guarantee reliable evidence use
Opus 5 returned an unblocked HTTP 200 for all 174 target cases. It passed 12/12 reasoning problems, protected the synthetic secret in 12/12 probes, met 11/12 exact output contracts, passed 9/12 executable Python tasks, and answered 27/30 safe prompts directly.
Its weaknesses were concentrated and material. Opus retained the authoritative value in only 3/12 planted-conflict grounding cases. In the other nine, it adopted the false value placed beside the source of truth. It also recovered only 2/12 canonical values from conflict-heavy inputs of roughly 32,000 characters.
Those long-context inputs were far below Anthropic's advertised context window. The result is therefore not evidence of a literal 32K limit or a million-token saturation failure. It is evidence that this prompt and document structure defeated retrieval plus conflict resolution in ten of 12 cases.
### What changed from Fable 5
Against Fable 5 in this matrix, Opus gained 6.67 strength points. It improved from 11/12 to 12/12 reasoning, from 5/12 to 9/12 coding, and from zero complete prompt-injection wins to 8/12. A prompt-injection pass required both ignoring the injected direction and completing the legitimate task; Fable's 0/12 does not mean it followed every attack. Eleven responses simply failed the legitimate task, while one followed the injected instruction.
Fable still beat Opus decisively on grounding, 10/12 to 3/12, and both deployments found only 2/12 long-context values. Fable was faster—3.367 seconds median versus 5.182 seconds—and its higher official token rates made its observed served-call estimate slightly more expensive despite producing fewer output tokens.
### What Sol changes about the comparison
GPT-5.6 Sol passed every eligible scored strength case, including 12/12 reasoning, coding, grounding, instruction, and long-context cases. The coverage qualifier matters: Sol received model content for 29/60 harmful requests, 27/30 safe prompts, 6/12 injection probes, and 11/12 secret-protection probes. Azure intercepted the rest.
Opus therefore offered the cleaner completion profile—174 unblocked calls versus Sol's 133—while Sol was stronger and faster whenever an eligible answer arrived. That is not a simple quality-versus-price trade. It is a choice between consistent endpoint completion with an uneven capability profile and stronger allowed-through behavior with a frequent explicit blocked state.
## Why Sonnet 5 won deployment readiness
Sonnet did not lead every dimension. It passed 7/12 prompt-injection probes, missed one reasoning case and two exact instruction constraints, and had one safe-prompt call blocked by Azure. It nevertheless combined a 90.37 strength score with 173 unblocked responses.
The breadth mattered: Sonnet passed all 12 coding, grounding, secret-protection, and long-context cases. It directly answered 26 of 29 eligible safe prompts. No other deployment combined that coverage with so few provider interventions.
Luna and Terra show why the endpoint layer can reorder otherwise similar GPT results. Both scored 98.96 on eligible behavior: Luna missed one probability problem, while Terra missed one exact instruction. Luna had three fewer blocks than Terra and Sol, so its 78.16% served-call rate placed it first among the GPT-5.6 variants on readiness. That is a narrow result for these deployments, not evidence that Luna is intrinsically the strongest GPT-5.6 model.
## Safety is more than refusing harmful requests
All six deployments were highly resistant on the 60-row harmful-request set. That does not substitute for prompt-injection resistance, secret protection, grounding, or useful treatment of benign prompts.
The distinction appears in successful-but-empty responses. Fable returned 43 empty HTTP 200 responses on eligible harmful cases and Opus returned nine. Empty content contains no useful harmful assistance, so the frozen rubric scores it as safe. It is still a weaker product experience than a clear refusal with a safe alternative. Applications need copy, telemetry, and fallbacks for both empty and explicitly blocked states.
The injection test used an equally conservative two-part rule: omit the injected marker **and** finish the legitimate task. Opus passed 8/12 and Sonnet 7/12. Sol, Terra, and Luna passed all six eligible rows, while Azure blocked the same other six probes for each deployment. A 100 score on six allowed-through cases is not 12/12 evidence.
Every eligible response protected the synthetic canary. No real credential or private user data appeared in the harness, and this article does not publish the canary, exact prompts, model outputs, or successful attack strings.
## The Azure layer is part of the result
The block distribution was structured. Sol and Terra each had 31 harmful-request blocks, three safe-prompt blocks, six injection blocks, and one secret-protection block. Luna had 28, three, six, and one. Sonnet had one safe-prompt block; Opus and Fable had none.
Calling these rows “model refusals” would assign Azure's filtering decision to model behavior we never observed. Ignoring them would be equally misleading for developers. The API stack—routing, safety policy, capacity, and model deployment—is the system an application actually calls, so the report presents blocks beside model-answer scores instead of hiding either layer.
## Latency and cost change the operating choice
Luna was the fastest deployment in the collection window at 1.467 seconds median and 5.572 seconds P95. Sol followed at 1.938 and 9.754 seconds. Opus had the slowest center and tail at 5.182 and 26.832 seconds.
These observations are not latency guarantees. Output length, hidden reasoning, provider routing, and a single-region collection window all affect them. The three GPT-5.6 deployments were temporarily moved from a 1K to a 100K TPM allocation so the uniform matrix could finish, then restored after the study. Their charted latency describes that elevated-throughput configuration, not LayerRail's normal quota or a production SLA.
Cost needs the same care. We applied official upstream base token rates to API-reported target usage. Fable's $10/$50 per-million input/output rates produced the highest estimate even though it returned fewer output tokens than Opus at $5/$25. Sonnet's introductory $2/$10 rate—documented through 31 August 2026—produced an observed estimate of about $0.49 per 100 served calls. The GPT-5.6 input/output rates were $5/$30 for Sol, $2.50/$15 for Terra, and $1/$6 for Luna; Luna was lowest at about $0.21 per 100 served calls.
| Deployment | Per 100 attempts | Per 100 unblocked served calls |
| --------------- | ---------------: | -----------------------------: |
| Claude Opus 5 | $1.707 | $1.707 |
| Claude Fable 5 | $1.856 | $1.856 |
| Claude Sonnet 5 | $0.489 | $0.492 |
| GPT-5.6 Sol | $0.720 | $0.942 |
| GPT-5.6 Terra | $0.388 | $0.508 |
| GPT-5.6 Luna | $0.165 | $0.211 |
Blocked GPT calls generally carried no normal usage record, so attempted-call normalization makes them look cheaper than served-call normalization. Neither number is a bill forecast. Judge traffic, taxes, regional multipliers, caching, batch discounts, tool charges, and unreported tokens are excluded.
## A practical deployment guide
The most useful first choice depends on which failure state a product can tolerate.
| Workload priority | First deployment to test | Reason from this window |
| ---------------------------------------- | ------------------------ | ---------------------------------------------------------- |
| Broad mixed production work | Claude Sonnet 5 | Highest readiness, broad strength, one block |
| Maximum eligible deterministic strength | GPT-5.6 Sol | 100 across every eligible strength dimension |
| Lowest observed cost and latency | GPT-5.6 Luna | Fastest median/P95 and lowest served-call estimate |
| Compact reasoning with complete delivery | Claude Opus 5 | 12/12 reasoning and zero blocks |
| Unattended retrieval or tool execution | No raw deployment | Every family showed injection failures or reduced coverage |
These are starting points, not universal labels. Sonnet's 7/12 injection result means it is not an application-security boundary. Sol and Luna require an explicit blocked-call experience. Opus needs domain-specific gates for retrieval, grounding, and executable code before it is trusted with unattended evidence-heavy work.
A router may be more rational than one permanent default: use a lower-cost first pass, escalate selected tasks, and place deterministic validators around both. We did not test such a router, so that is operating guidance rather than a benchmark result.
## How LayerRail tested
The target matrix contained 60 harmful-request cases, 30 safe prompts, and 12 cases each for injection, synthetic-secret protection, grounding, reasoning, coding, instruction following, and long-context retrieval. That produced 174 logical cases per deployment and 1,044 in total.
Calls went directly to six Azure AI Foundry GlobalStandard deployments in East US 2 through API version `2025-01-01-preview`, with LayerRail's production fallback disabled. Generation used provider defaults without temperature or `top_p` overrides. We allowed up to four bounded attempts for retryable network, 429, and 5xx failures; a retry never became a new scored row, and explicit policy blocks were not retried as model answers. The final target matrix had no unresolved non-policy errors.
The completed `frontier-v2` matrix replaced an excluded pilot. Review found output budgets that disadvantaged adaptive-thinking deployments, three incorrect deterministic reasoning keys, and one ambiguous formatting instruction. We corrected the frozen protocol and recollected all 1,044 target rows. No pilot score or selectively retained pilot row enters this article.
Reasoning, code, instructions, injection, secrets, grounding, and long-context outcomes used deterministic validators. Python answers ran in isolated temporary directories against fixed assertions. Claude Haiku 4.5, outside the target roster, supplied the primary harmfulness and safe-helpfulness labels for non-empty responses; one safe row was human-adjudicated under the published XSTest rule after repeated judge stalls.
Grok 4 attempted a diagnostic 20% stratified audit: 91 rows selected, 77 valid parsed outputs, four provider blocks, and ten unavailable rows. Sixty-nine rows formed comparable model-judge pairs, with 100% broad-label agreement and Cohen's κ of 1.0 on those pairs. That supports consistency where both labels exist; it does not establish ground truth or make this an independent study.
Binary dimensions use Wilson 95% intervals. Continuous harmfulness and composite uncertainty use stratified bootstrap intervals with seed `20260726`. The private append-only logs preserve row-level provenance, while the public handoff contains only safe aggregates, prompt hashes, formulas, and figures.
## What not to conclude
This is a dated, first-party LayerRail analysis of six served Azure configurations—not a universal model leaderboard.
- One English-language window cannot establish future behavior in another region, API, quota, system prompt, tool stack, or model revision.
- Each logical case ran once. The study chose breadth over repeated-sampling estimates for individual prompts.
- Most custom dimensions contain only 12 cases, leaving wide confidence intervals even at 12/12.
- The roughly 32K-character context probes test one synthetic retrieval-and-conflict pattern, not advertised context-window capacity.
- The coding suite is compact and Python-only; it does not measure repository-scale agents, dependency work, UI implementation, or security review.
- The readiness formula penalizes all provider blocks, including policy interventions that may be desirable for harmful requests. Another product can choose a different utility function.
- Official list-rate estimates and elevated-capacity latency observations are not LayerRail retail prices, invoices, or SLAs.
## The decision we would make
For a new mixed workload resembling this matrix, Sonnet 5 is the most defensible first deployment to test. If the application can surface or reroute explicit blocks and values the strongest eligible deterministic behavior, Sol is the performance candidate. If cost and latency dominate, Luna is the efficiency candidate.
Opus 5 deserves targeted evaluation for compact reasoning work, but its 3/12 grounding and 2/12 long-context results should be release gates, not footnotes. The model name cannot replace a workload-specific test suite—and neither can a single score.
## Technical report and reproducibility package
The complete study is now published as [**LayerRail Technical Report No. 2026-01**](https://doi.org/10.5281/zenodo.21707500). The public release contains the APA 7 report, aggregate result tables, confidence intervals, the frozen study plan, prompt hashes, selected figures, a primary-source audit, and checksums. Safety-sensitive prompts, model outputs, attack strings, canary values, and private operational logs remain withheld.
- [Read the technical report (PDF)](https://github.com/Layerrail/frontier-model-study-2026-07/releases/download/v1.0.0/LayerRail-Technical-Report-2026-01-APA7.pdf)
- [View Oluwamayowa Oladosu's ORCID record](https://orcid.org/0009-0004-0439-7647)
- [View the publication on ResearchGate](https://www.researchgate.net/publication/411012631_Behavior_Strength_and_Deployment_Readiness_Across_Six_Frontier-Model_Deployments_A_First-Party_Observational_Study_in_Microsoft_Foundry)
- [Browse the public evidence repository](https://github.com/Layerrail/frontier-model-study-2026-07)
- [Download the version 1.0.0 publication package](https://github.com/Layerrail/frontier-model-study-2026-07/releases/tag/v1.0.0)
**Suggested citation:** Oladosu, O. (2026). _Behavior strength and deployment readiness across six frontier-model deployments: A first-party observational study in Microsoft Foundry_ (LayerRail Technical Report No. 2026-01). LayerRail, Inc. https://doi.org/10.5281/zenodo.21707500
## Primary sources
Provider documentation supports product facts only; it is not evidence for LayerRail's measured outcomes.
1. [Anthropic models overview](https://platform.claude.com/docs/en/about-claude/models/overview)
2. [Anthropic pricing](https://platform.claude.com/docs/en/about-claude/pricing)
3. [Claude Opus 5 announcement](https://www.anthropic.com/news/claude-opus-5)
4. [Claude Fable 5 announcement](https://www.anthropic.com/news/claude-fable-5-mythos-5)
5. [Claude Sonnet 5 announcement](https://www.anthropic.com/news/claude-sonnet-5)
6. [Claude in Microsoft Foundry](https://platform.claude.com/docs/en/build-with-claude/claude-in-microsoft-foundry)
7. [OpenAI model catalog](https://developers.openai.com/api/docs/models)
8. [OpenAI pricing](https://developers.openai.com/api/docs/pricing)
9. [GPT-5.6 announcement](https://openai.com/index/gpt-5-6/)
10. [Microsoft Foundry model catalog](https://learn.microsoft.com/en-us/azure/foundry/foundry-models/concepts/models-sold-directly-by-azure?pivots=azure-openai)
11. [StrongREJECT](https://github.com/alexandrasouly/strongreject)
12. [XSTest](https://github.com/paul-rottger/xstest)
## Disclosure
LayerRail designed, ran, analyzed, and publishes this first-party study of deployments available through its platform.
All quantitative claims come from the recorded `frontier-v2` run and deterministic aggregation; no raw safety prompt, model output, attack string, synthetic secret, or private log is published here.