Dev

Put the more agentic model in the reviewer's seat

The traits that make a model more agentic (it expands scope, verifies itself unprompted, writes longer) are a liability in a bounded unattended worker and an asset in a reviewer. So the fleet's workers run on Claude Opus 4.8 while Opus 5 does the reviewing. A field note on matching a model's disposition to its role, not its benchmark.

I moved a fleet of scheduled agents from Claude Opus 4.8 to Opus 5, and they got worse at their jobs. Not dramatically. Subtly, in the way that costs you a week before you name it. Answers ballooned. Agents kept changing things nobody asked them to change. Simple tasks grew extra steps. My first instinct was that I had broken a prompt somewhere.

I hadn't. The model was exhibiting exactly the behavior differences Anthropic documents for it. The problem was that I had put it in the wrong seat.

The traits are documented, and they are not bugs

When I stopped treating it as a regression and read Anthropic's own Opus 5 guidance, every symptom was there in plain text. Default responses run longer than on prior Opus models. Task scope expansion: the model can add steps you didn't request, or apply its own judgment about what the task should be. It verifies its own work unprompted, and delegates to sub-agents more readily than 4.8 did. These are documented characteristics of the release, not evidence my prompt was broken. They are the shape of a more agentic model, one that leans toward doing more, checking more, and saying more.

Now put that shape in a bounded, unattended worker that wakes on a timer, runs one narrow task, and goes back to sleep. Those traits can turn into liabilities. In a file-writing worker, scope expansion can mean edits outside the intended task. Unprompted self-correction is a strength by default — but a carried-over "verify your work" instruction compounds it into the over-verification Anthropic warns about, and the tokens add up. More narration means longer runs and more surface for drift. A bounded worker's whole value is that it does the assigned thing tightly and stops, and in my scheduled jobs Opus 5 needed more explicit scope control than 4.8 to hold that line.

The same shape, one seat over, is exactly what you want

Here is the move that took me too long to see. Those traits are only liabilities relative to the role. Point the same model at review instead of building, and each one turns into an asset.

A reviewer that expands scope traces the adjacent code you didn't ask it to look at, and finds the sibling function your change half-broke. A reviewer that verifies unprompted re-derives the claim in your commit message instead of trusting it. Extra detail earns its keep when the brief rewards thoroughness. What breaks a builder builds a critic.

So the fleet settled into an asymmetry that reads backwards on a spec sheet: bounded workers run on Opus 4.8; Opus 5 runs as a reviewer. The worker does what it's told and stops. The reviewer roams, doubts, and over-checks, and I want all three when it's grading someone else's work, and none of them when it's doing mine. None of this says Opus 5 is a weaker model — Anthropic pitches it as strong at exactly this kind of agentic, multi-file coding. It says its disposition fits a different seat than the one I first sat it in.

The remedy that inverts the usual advice

One detail is worth stealing even if you never touch a fleet. Anthropic's fix for Opus 5 over-verifying is to delete the self-verification instructions you carried over from an older model, and they flag that this inverts the usual "ask the model to double-check its work" best practice. On Opus 5 specifically, a carried-over "please verify" can compound the model's own checking and add cost without improving the result. Don't generalize that to every capable model, though: Anthropic's guidance for Claude Fable 5 recommends the opposite, explicit self-verification in long-running prompts. Agenticity alone doesn't set the right verification policy; the specific model does. The same nuance holds for length: verbosity is a prompting lever, not an effort lever — lowering effort reduces thinking volume but doesn't reliably shorten what the model writes.

The honest part

My first write-up of this was cleaner and wronger. It said, in effect, "the new model is worse." I ran it through reviews from two different model families, and they independently challenged that claim: one identified a documented behavior I had misread; the other caught a change I'd made the same week and wrongly blamed on the model. The simple story didn't survive contact with a skeptical reader who wasn't me.

Which is the whole point, twice over. The lesson isn't "newer is worse" — it's that a model has a disposition, and a disposition has a right seat. And the way I found the right version of even this argument was to hand it to the more agentic model and let it do what it does best: expand the scope, distrust the claim, and tell me what I got wrong.

Discussion

No comment section here — all discussions happen on X.

Max Nardit

Max Nardit

@mnardit

More articles

An exit is not a verdict

A monitor that pages on a process's absence is answering the question you can already see the answer to. Whether a job is gone is cheap to detect and almost never the thing that matters. Whether it failed or was deliberately stopped, by a deploy, a reboot, an operator, is what a page turns on, and a bare exit carries only a sliver of that story.

A model is a dependency that won't hold still

A pinned software library is an artifact you can inspect and rerun: if the output changed and you didn't, something you can read changed, and you can find out what. A model breaks that. It shifts behind an unchanged name, loses capacity without notice, and drifts in disposition, so a regression arrives with no cause you can point to and you waste a week blaming your own prompt. Treat it as a dependency you measure, not a foundation you trust: pin the version so you own the moment it changes, and fix a small panel of cheap metrics in advance so you can tell the vendor's drift from your own.

Your approval gate is a guess now

A security boundary is judged on the one action built to cross it, and a model judging by resemblance is weakest exactly there. The unattended allow belongs on the reach the harness itself grants, the write scope, the network, the credential, refusing what it cannot account for. Trust the model as the boundary and you rebuild the seam that prompt-injection detection could never close.