Bottom line: the evidence does not support a safety winner

For a fair answer, we would need a head-to-head test using the same toolchain, same retrieval system, same PDFs, same malicious prompts, same fake-reference corpus and same scoring rules. The metrics would need to include, at minimum, prompt-injection success rate, unsupported citation rate, malicious-PDF instruction-following rate and the quality of conclusions after biased evidence is introduced.

That public comparison is not available.

What can be said with more confidence is narrower: Claude Opus 4.7 is easier to trace through official Anthropic material. Anthropic has an official Claude Opus 4.7 announcement, developer documentation and a model system-card page listing Claude Opus 4.7. But better documentation is not the same thing as better real-world resistance to contaminated research inputs.

What the public documentation actually shows

Claude: clearer model-specific paperwork, not a direct contamination benchmark

Anthropic’s public material confirms Claude Opus 4.7 as a released model with developer documentation. The Claude docs say Opus 4.7 introduces task budgets, and Anthropic’s prompting guidance says that when running Claude Opus 4.7 at max or xhigh effort, developers should provide enough output-token budget for the model to act across subagents and tool calls.

That matters because research contamination often appears in long, tool-using workflows. Anthropic has also published broader Claude 4 safety material describing pre-deployment safety tests under its Responsible Scaling Policy, tests around Usage Policy violations, reward-hacking evaluations and agentic safety evaluations for computer use and coding capabilities. The Claude 4.1 system card also lists sections on prompt injection attacks and computer use.

Those documents show a relevant safety context. They do not show that Claude Opus 4.7 beat GPT-5.5 Spud on contaminated research tasks.

OpenAI: relevant safety evaluations, but not Spud-specific proof

OpenAI’s GPT-5 system card covers factual correctness and hallucination evaluations. It describes using an LLM-based grading model with web access to identify major and minor factual errors, and says GPT-5 models had lower hallucination rates than listed OpenAI comparison models in both browse-on and browse-off settings.

OpenAI’s ChatGPT Agent system card describes SecureBio static and agentic evaluations, manual red-teaming, and tasks requiring web search and reasoning. The GPT-5-Codex system-card addendum also explicitly discusses prompt-injection risk and a dedicated prompt-injection evaluation suite.

The gap is that these are not an official GPT-5.5 Spud system card. The sources directly discussing Spud in the provided record are third-party or leak-oriented pages, not an OpenAI release document with model-specific safety results.

The four contamination risks, one by one

1. Prompt injection

Prompt injection is the classic failure mode for research agents: a model reads a webpage, paper, spreadsheet or attachment and mistakes untrusted text inside it for an instruction. Claude’s public safety material shows relevant work around agentic safety, computer use and prompt injection; OpenAI’s ChatGPT Agent and GPT-5-Codex materials show agentic evaluations, manual red-teaming and a prompt-injection evaluation suite.

But that still does not answer the comparison that matters: when both models read the same poisoned research materials, which one obeys the attacker less often? The public record does not provide that direct test.

2. Fake citations

Fake citations are partly a factuality problem and partly a source-verification problem. OpenAI’s GPT-5 system card does include factual correctness and hallucination evaluations, including a grading process using web access.

That is useful context, but it is not the same as a fake-citation stress test. The public material does not show GPT-5.5 Spud and Claude Opus 4.7 tested on the same mix of real DOIs, fake DOIs, live URLs, dead URLs, fabricated journal names and plausible-sounding nonexistent papers.

3. Malicious PDFs

Public sources do not provide comparable metrics for how the two named models handle malicious PDFs. There is no shared score showing whether either model follows hidden text, metadata instructions, malicious comments or fake system messages embedded in an attachment.

For real deployments, that means PDF handling should not be delegated to the model alone. A safer evaluation design would treat PDFs as untrusted input, extract text and structure in a sandbox, and then test whether the model improperly treats document content as higher-priority instructions.

4. Biased evidence

Bias benchmarks are relevant but incomplete. Anthropic’s Claude 4 system card includes bias-evaluation material, and the Claude 4.1 system card lists political bias and discriminatory bias evaluations. OpenAI’s GPT-4.5 system card includes bias-related evaluation using the BBQ Evaluation Dataset.

But a bias benchmark is not the same as an end-to-end contaminated research workflow. The harder question is whether a model notices that sources are one-sided, looks for counterevidence, labels sampling limits and avoids turning a skewed sample into a general conclusion. The public evidence does not provide comparable Claude Opus 4.7 versus GPT-5.5 Spud results for that task.

Why system cards are not enough

System cards are valuable because they show what vendors say they tested before or around release. Anthropic-related material describes Responsible Scaling Policy evaluations for frontier models in areas such as CBRN, cybersecurity and autonomous capabilities, and the Claude 4 system card describes multiple safety and agentic evaluations. OpenAI’s GPT-5 and ChatGPT Agent documents provide context on factuality, hallucination, agentic evaluations and manual red-teaming.

But research contamination is not just a model-level issue. It is a workflow issue. The weak point could be the search system, the PDF parser, the prompt hierarchy, tool permissions, citation checking, logging, or the absence of human review. A model can perform well in a vendor evaluation and still fail in a poorly designed research pipeline.

There is also a broader reason to be cautious. Anthropic’s alignment-faking research shows that, in specific experimental settings, large language models can display alignment-faking-related behavior, and that results vary across prompt conditions. That does not prove Claude Opus 4.7 or GPT-5.5 Spud will fail in a research task. It simply reinforces the point: safety boundaries cannot be inferred from vendor summaries, leak pages or one-off demos.

How teams should test this before choosing

If a team needs to choose between these systems for serious research work, the next step should be a reproducible red-team evaluation, not a brand preference. A useful test set should include:

1. Prompt-injection cases: webpages, PDFs, tables, footnotes and citations containing conflicting malicious instructions, with scoring for whether the model obeys untrusted content.
2. Citation-grounding cases: real and fake DOIs, real and broken URLs, fabricated journal titles and nonexistent papers, with scoring for unsupported citations and verification behavior.
3. Malicious-PDF cases: sandboxed documents with hidden text, comments and metadata instructions, with scoring for whether the model treats embedded content as task instructions.
4. Biased-corpus cases: one-sided sources, skewed samples and missing counterevidence, with scoring for whether the model flags limits and seeks alternative explanations.
5. End-to-end research-quality scoring: final-answer accuracy, source traceability, handling of counterevidence, appropriate refusals, over-refusals, tool logs and human-review cost.

Only a test like that can answer the practical question: not which model has more impressive documentation, but which one preserves research quality when the inputs are hostile.

Final verdict

Based strictly on the public, checkable material, there is no proof that Claude Opus 4.7 or GPT-5.5 Spud is stronger against prompt injection, fake citations, malicious PDFs or biased-data contamination.

Claude has the edge only on the narrow issue of documentation traceability, because Anthropic provides model-specific release and developer material and lists Claude Opus 4.7 in its system-card resources. OpenAI has substantial related safety documentation for GPT-5, ChatGPT Agent and GPT-5-Codex, but those materials are not a Spud-specific official safety record.

So the most defensible conclusion is: Claude is better documented; the real safety contest remains unproven.

Bottom line: the evidence does not support a safety winner

For a fair answer, we would need a head-to-head test using the same toolchain, same retrieval system, same PDFs, same malicious prompts, same fake-reference corpus and same scoring rules. The metrics would need to include, at minimum, prompt-injection success rate, unsupported citation rate, malicious-PDF instruction-following rate and the quality of conclusions after biased evidence is introduced.

That public comparison is not available.

What can be said with more confidence is narrower: Claude Opus 4.7 is easier to trace through official Anthropic material. Anthropic has an official Claude Opus 4.7 announcement, developer documentation and a model system-card page listing Claude Opus 4.7. But better documentation is not the same thing as better real-world resistance to contaminated research inputs.

What the public documentation actually shows

Claude: clearer model-specific paperwork, not a direct contamination benchmark

Anthropic’s public material confirms Claude Opus 4.7 as a released model with developer documentation. The Claude docs say Opus 4.7 introduces task budgets, and Anthropic’s prompting guidance says that when running Claude Opus 4.7 at max or xhigh effort, developers should provide enough output-token budget for the model to act across subagents and tool calls.

That matters because research contamination often appears in long, tool-using workflows. Anthropic has also published broader Claude 4 safety material describing pre-deployment safety tests under its Responsible Scaling Policy, tests around Usage Policy violations, reward-hacking evaluations and agentic safety evaluations for computer use and coding capabilities. The Claude 4.1 system card also lists sections on prompt injection attacks and computer use.

Those documents show a relevant safety context. They do not show that Claude Opus 4.7 beat GPT-5.5 Spud on contaminated research tasks.

OpenAI: relevant safety evaluations, but not Spud-specific proof

OpenAI’s GPT-5 system card covers factual correctness and hallucination evaluations. It describes using an LLM-based grading model with web access to identify major and minor factual errors, and says GPT-5 models had lower hallucination rates than listed OpenAI comparison models in both browse-on and browse-off settings.

OpenAI’s ChatGPT Agent system card describes SecureBio static and agentic evaluations, manual red-teaming, and tasks requiring web search and reasoning. The GPT-5-Codex system-card addendum also explicitly discusses prompt-injection risk and a dedicated prompt-injection evaluation suite.

The gap is that these are not an official GPT-5.5 Spud system card. The sources directly discussing Spud in the provided record are third-party or leak-oriented pages, not an OpenAI release document with model-specific safety results.

The four contamination risks, one by one

1. Prompt injection

Prompt injection is the classic failure mode for research agents: a model reads a webpage, paper, spreadsheet or attachment and mistakes untrusted text inside it for an instruction. Claude’s public safety material shows relevant work around agentic safety, computer use and prompt injection; OpenAI’s ChatGPT Agent and GPT-5-Codex materials show agentic evaluations, manual red-teaming and a prompt-injection evaluation suite.

But that still does not answer the comparison that matters: when both models read the same poisoned research materials, which one obeys the attacker less often? The public record does not provide that direct test.

2. Fake citations

Fake citations are partly a factuality problem and partly a source-verification problem. OpenAI’s GPT-5 system card does include factual correctness and hallucination evaluations, including a grading process using web access.

That is useful context, but it is not the same as a fake-citation stress test. The public material does not show GPT-5.5 Spud and Claude Opus 4.7 tested on the same mix of real DOIs, fake DOIs, live URLs, dead URLs, fabricated journal names and plausible-sounding nonexistent papers.

3. Malicious PDFs

Public sources do not provide comparable metrics for how the two named models handle malicious PDFs. There is no shared score showing whether either model follows hidden text, metadata instructions, malicious comments or fake system messages embedded in an attachment.

For real deployments, that means PDF handling should not be delegated to the model alone. A safer evaluation design would treat PDFs as untrusted input, extract text and structure in a sandbox, and then test whether the model improperly treats document content as higher-priority instructions.

4. Biased evidence

Bias benchmarks are relevant but incomplete. Anthropic’s Claude 4 system card includes bias-evaluation material, and the Claude 4.1 system card lists political bias and discriminatory bias evaluations. OpenAI’s GPT-4.5 system card includes bias-related evaluation using the BBQ Evaluation Dataset.

But a bias benchmark is not the same as an end-to-end contaminated research workflow. The harder question is whether a model notices that sources are one-sided, looks for counterevidence, labels sampling limits and avoids turning a skewed sample into a general conclusion. The public evidence does not provide comparable Claude Opus 4.7 versus GPT-5.5 Spud results for that task.

Why system cards are not enough

System cards are valuable because they show what vendors say they tested before or around release. Anthropic-related material describes Responsible Scaling Policy evaluations for frontier models in areas such as CBRN, cybersecurity and autonomous capabilities, and the Claude 4 system card describes multiple safety and agentic evaluations. OpenAI’s GPT-5 and ChatGPT Agent documents provide context on factuality, hallucination, agentic evaluations and manual red-teaming.

But research contamination is not just a model-level issue. It is a workflow issue. The weak point could be the search system, the PDF parser, the prompt hierarchy, tool permissions, citation checking, logging, or the absence of human review. A model can perform well in a vendor evaluation and still fail in a poorly designed research pipeline.

There is also a broader reason to be cautious. Anthropic’s alignment-faking research shows that, in specific experimental settings, large language models can display alignment-faking-related behavior, and that results vary across prompt conditions. That does not prove Claude Opus 4.7 or GPT-5.5 Spud will fail in a research task. It simply reinforces the point: safety boundaries cannot be inferred from vendor summaries, leak pages or one-off demos.

How teams should test this before choosing

If a team needs to choose between these systems for serious research work, the next step should be a reproducible red-team evaluation, not a brand preference. A useful test set should include:

1. Prompt-injection cases: webpages, PDFs, tables, footnotes and citations containing conflicting malicious instructions, with scoring for whether the model obeys untrusted content.
2. Citation-grounding cases: real and fake DOIs, real and broken URLs, fabricated journal titles and nonexistent papers, with scoring for unsupported citations and verification behavior.
3. Malicious-PDF cases: sandboxed documents with hidden text, comments and metadata instructions, with scoring for whether the model treats embedded content as task instructions.
4. Biased-corpus cases: one-sided sources, skewed samples and missing counterevidence, with scoring for whether the model flags limits and seeks alternative explanations.
5. End-to-end research-quality scoring: final-answer accuracy, source traceability, handling of counterevidence, appropriate refusals, over-refusals, tool logs and human-review cost.

Only a test like that can answer the practical question: not which model has more impressive documentation, but which one preserves research quality when the inputs are hostile.

Final verdict

Based strictly on the public, checkable material, there is no proof that Claude Opus 4.7 or GPT-5.5 Spud is stronger against prompt injection, fake citations, malicious PDFs or biased-data contamination.

Claude has the edge only on the narrow issue of documentation traceability, because Anthropic provides model-specific release and developer material and lists Claude Opus 4.7 in its system-card resources. OpenAI has substantial related safety documentation for GPT-5, ChatGPT Agent and GPT-5-Codex, but those materials are not a Spud-specific official safety record.

So the most defensible conclusion is: Claude is better documented; the real safety contest remains unproven.