Claude Opus 4.8: securing long-running AI agent work

Claude Opus 4.8 was announced on 28 May 2026 for complex coding and long-running agentic work, with a context window up to one million tokens. Anthropic offers it through Claude Platform and cloud providers, highlighting increased autonomy on multi-step work.

Long context and persistence reduce manual intervention, but can carry one incorrect assumption through a larger part of the system.

Context is not a trust boundary

One context can contain system instructions, code, documentation, tickets, logs, MCP output and internet content. The model may give too much weight to an untrusted passage, especially one written like an operating procedure.

Label provenance for every block. Keep secrets out of context even when they are needed once. Supply a short-lived credential directly to the tool instead of exposing it as model-readable text.

Turn autonomy into transactions

Split a long plan into stages with explicit state and acceptance. Each stage needs:

• inputs and owner;
• permitted tools;
• maximum impact;
• completion evidence;
• rollback route;
• time and cost limit.

An agent should not move from “propose a migration” to “change the production database” without a new policy decision.

Narrow tool contracts

General bash, kubectl or SQL creates an enormous error surface. Safer interfaces expose create_preview, run_readonly_query, open_pull_request and request_deployment.

A validator outside the LLM checks repository, environment, limits, file type and recipient. For irreversible actions, separate preparation and approval.

Compaction can lose constraints

Long tasks often summarise context. Test whether compaction preserves the objective, prohibited actions, owner, success criteria and distrust of retrieved content. A summary must not hide “do not deploy”.

After compaction, reload a short immutable policy manifest. Do not rely on the model to retain every constraint.

Monitor effects, not only text

Log tool calls, validated arguments, policy decisions and actual effects. A transcript may claim that a backup exists while the API failed or touched another resource.

Alert on new domains, unusual scopes, sudden operation volume and tool use outside the plan. Correlate agent identity with the initiating user through non-human identity controls.

Red-team the long horizon

Single-turn jailbreak tests do not represent long work. Test poisoned repositories, instructions in issues, objective changes after compaction, conflicting tools, partial failures and retries causing duplicate effects.

Verify that the agent can stop and escalate uncertainty. Autonomous completion is not success when the conditions changed halfway through.

Production pattern

1. One identity and owner per agent.
2. Immutable policy manifest.
3. Separate planning and execution stages.
4. Narrow tools with idempotency keys.
5. Short-lived credentials per stage.
6. Checkpoints after compaction and environment changes.
7. Time, cost and action-count limits.
8. Kill switch, rollback and incident playbook.

Treat Opus 4.8 as a fast operator executing long procedures, not a new administrator. The more capable the model, the smaller its uncontrolled execution surface should be.

---

Controlling a long-running task

Greater model capability does not change the permission boundary. Give the agent a separate identity, short-lived credentials and minimum tools for the task. Each phase needs time, cost and operation limits, while checkpoints permit safe resumption without repeating side effects.

Before an irreversible action, show a human the plan, object, scope and expected effect. Test indirect prompt injection, poisoned repositories, faulty tool output and partial failure. Cite parameters and safety results from the system card for the exact version; do not transfer evaluations automatically from another model or environment.

Sources: Anthropic — Claude Opus, Claude Opus 4.8 System Card, Anthropic System Cards.