Opus 5.5 hands cyber tasks to Opus 4.8: log the model id

A request that Opus 5.5 treats as cybersecurity work may be answered by a different model. Anthropic's launch post says most cybersecurity tasks will be re-routed to Opus 4.8 (read 2026-10-04). Most video, image and ad work never touches that path, but if a run about, say, a security product demo comes back different from the rest, that is a place to look.

The way to know is to record which model answered, and Sume already gives you a field for part of that.

What does Sume echo back?

Sume's Create a run page says the receipt echoes the model id that ran. That is the orchestrator id Sume used for the run. It is the one you chose, or the default when you left the field out. It does not describe a vendor-side hand-off inside a provider's own service, which Sume's docs do not cover.

How do I use it?

Treat a surprising result as a hypothesis to test, not a verdict.

• Re-run the same input once with a different model id and compare.
• Reword the instruction to what you actually want made, since security vocabulary can change handling.
• Keep the failing run id when you contact support.