Claude Haiku 5.5 is a strong pentesting model for its size and price. Its best NexBench run scored 45, tying Claude Opus 4.8 for sixth of 19 models. That run cost $10.46, against $155 for Opus 4.8. Anthropic's public safeguards still block penetration testing, so plan for refusals outside approved access.
Claude Haiku 5.5 is Anthropic's newest small model, released on October 7, 2026. It lists at $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 100,000 tokens, per Anthropic's docs . We ran it through NexBench at all five effort levels. This post covers how it scored and what its safeguards allow.
Is Claude Haiku 5.5 good at cybersecurity?
Anthropic's own tests set low expectations. A pre-release Haiku 5.5 completed 3.3% of multi-stage cyber range challenges, against 46.1% for Sonnet 5.5, per Help Net Security . On known Chrome V8 bugs, it reached arbitrary code execution in 4 of 410 runs.
It is far better at agent work than its predecessor, though. Haiku 5.5 scored 39.2% on Terminal-Bench 4.0, up from 0.0% for Haiku 4.5, per Anthropic . Long tool-use sessions like these are close to what a pentesting agent does all day.
How do you benchmark an LLM for pentesting?
We use NexBench, MindFort's internal benchmark for AI models doing offensive security work. Each model runs inside a portable version of our production agent harness. It then runs an authorized pentest of a realistic web app. That tests its decision-making, execution, and reasoning in a real-world environment.
An independent GPT-5.5 validator reproduces every finding before it counts. High and critical findings score 3 points, medium findings score 2, and low findings score 1. Each run stops at a five-hour cap, and the full method is in our NexBench write-up.
Is Claude Haiku 5.5 good for AI pentesting?
Yes, especially for the price. Its best NexBench run scored 45 at max effort, tying Claude Opus 4.8 for sixth of 19 models. All 15 findings in that run were high severity. It cost $10.46, against $155.25 for Opus 4.8's best run.
Top NexBench scores
Highest validator-accepted score each model reached at any reasoning effort, top six of 19 shown. Claude Haiku 5.5, highlighted, ties Claude Opus 4.8 at 45.
It was less precise than the bigger Claude models. Across five runs, 8 of its 81 submissions failed validation, against 2 of 70 for Opus 4.8. The live NexBench standings will update as we add runs.
Is Claude Haiku 5.5 better than Sonnet 5 for pentesting?
Yes. We never ran Haiku 4.5 on NexBench, so the closest comparison is the bigger Claude models we have tested. Haiku 5.5's best run beat Claude Sonnet 5's by 32%, from 34 to 45. It matched Opus 4.8's best score for 93% less money.
| NexBench result, five runs each | Sonnet 5 | Opus 4.8 | Haiku 5.5 |
|---|---|---|---|
| Best score | 34 | 45 | 45 |
| Validated findings | 54 | 68 | 73 |
| High-severity findings | 31 | 38 | 42 |
| Rejected findings | 1 | 2 | 8 |
| Best-run cost | $146.26 | $155.25 | $10.46 |
| Total cost | $373.96 | $380.18 | $51.06 |
| Cost per validated finding | $6.93 | $5.59 | $0.70 |
We have not run Sonnet 5.5 or Opus 5.5 on NexBench yet. Until we do, Haiku 5.5 is the best value of any Claude model on the board. It also found the most high-severity bugs of the three, 42 to Opus 4.8's 38.
Score vs. cost per run
Every model-effort run by standard cost against score. Claude Haiku 5.5's five runs, highlighted with Sonnet 5 and Opus 4.8, all cost under $16.
Which effort level should a Claude Haiku 5.5 pentesting agent use?
Medium, unless you can wait for a long run. Medium effort scored 37 in 25 minutes, more than triple the 11 that low effort scored. Max effort added another 22% but ran to the five-hour cap.
| Effort | Score | Validated findings | High severity | Run time | Cost |
|---|---|---|---|---|---|
| Low | 11 | 5 | 2 | 8 min | $2.31 |
| Medium | 37 | 16 | 8 | 25 min | $15.82 |
| High | 38 | 18 | 8 | 34 min | $12.71 |
| X-High | 42 | 19 | 9 | 1.23 hrs | $9.76 |
| Max | 45 | 15 | 15 | 5 hrs | $10.46 |
Cost did not climb with effort. The xhigh run cost $9.76, less than the medium run, and scored 42. Anthropic's prompting guide makes medium the default. It saves xhigh and max for work where the gain justifies the cost.
Why does a small model do well at pentesting inside a harness?
The harness carries much of the load. Haiku 5.5 cleared 3.3% of Anthropic's cyber ranges but tied Opus 4.8 on NexBench. Our harness splits an engagement into narrow tasks that a manager hands to subagents. Anthropic itself pitches Haiku 5.5 as a subagent for its bigger models, per its launch post .
Does Claude Haiku 5.5 refuse pentesting tasks?
Yes, on the public API. Anthropic says its safeguards "still block penetration testing and other techniques more likely to be used by attackers," per its launch post . Finding vulnerabilities in source code is allowed. A blocked request returns a cyber refusal, and there is no fallback model, per Anthropic's docs .
The safeguards are also stricter than Haiku 4.5's. Haiku 5.5 refused 84.3% of malicious requests in Claude Code, up from 66.6%, per Help Net Security . Teams doing authorized testing can apply to Anthropic's Cyber Verification Program . Its Red Team Access tier covers authorized penetration testing.
How much does Claude Haiku 5.5 cost to run as a pentesting agent?
Very little. All five NexBench runs together cost $51.06, or $0.70 per validated finding. Only DeepSeek V4.1-Flash-1017 came in cheaper per finding, at $0.60.
Watch the token count, though. The new tokenizer turns the same text into about 30% more tokens than Haiku 4.5, per Anthropic's migration guide . Prompts over 100,000 tokens also cost five times more per token.
Should you build your own pentesting agent or buy one?
Buy, unless you want to own the hard part. Haiku 5.5 shows how far a cheap model goes when a good harness breaks the work into small jobs. Building that harness is hard. It has to scope targets, coordinate subagents for hours, and reproduce every exploit inside authorized systems.
MindFort makes that part easy. Our pentesting swarms run on MF-1, our custom LLM built for offensive security reasoning, inside the same harness NexBench is built on. Every proven finding comes back as a merge-ready GitHub PR. Multiple Fortune 500 companies and top startups already use them, and you can book a demo to see them on your stack.
FAQ
Is Claude Haiku 5.5 good at pentesting?
Yes, for a small model. Its best NexBench run scored 45 and tied Claude Opus 4.8 for sixth of 19 models. All 15 findings in that run were high severity. The run cost $10.46.
Is Claude Haiku 5.5 better than Sonnet 5 for pentesting?
On NexBench, yes. Its best run scored 45 against Sonnet 5's 34, a 32% gain. Across five runs it validated 73 findings to Sonnet 5's 54. It cost $0.70 per validated finding against $6.93.
Does Claude Haiku 5.5 refuse penetration testing?
On the public API, yes. Anthropic says its safeguards still block penetration testing. Finding vulnerabilities in source code is allowed. Organizations doing authorized testing can apply to Anthropic's Cyber Verification Program.
What effort level should a Claude Haiku 5.5 pentesting agent use?
Start at medium, the default. It scored 37 in 25 minutes on NexBench, more than triple the 11 that low effort scored. Max effort scored 45 but ran to the five-hour cap.
How much does Claude Haiku 5.5 cost?
It lists at $0.10 per million input tokens and $0.50 per million output tokens for prompts up to 100,000 tokens. Longer prompts cost five times more per token. Its five NexBench runs cost $51.06 in total.
About the author
Brandon Veiseh
Co-Founder & CEO · MindFort
Founded his first startup building NLP models for network packet inspection. Led product at ProjectDiscovery, built their enterprise platform from scratch. At NetSPI, led development of AI tools for offensive security.