Anthropic has announced that its latest AI model, Opus 5, is nearly immune to prompt injection attacks when used within the company's own software. Prompt injection is a security vulnerability where an attacker bypasses an AI model's instructions by manipulating inputs, such as hidden text on a webpage.
Zero Percent Success in Browser Agent Tests
According to the system card released by Anthropic, the attack success rate for browser agents dropped to zero percent across 129 test scenarios. This is a significant achievement given that OpenAI admitted in December that prompt injection may never be fully solved.
General Prompt Injection Benchmark Results
In a general prompt injection test conducted by security firm Gray Swan, the success rate after 15 attempts fell from 5.5 percent with Opus 4.8 to 2.0 percent with Opus 5. Opus 5 now leads the Gray Swan IPI benchmark, followed by Mythos 5 at 2.6 percent and Fable 5 at 2.8 percent.
Auto Mode Provides Dual Defense Layers
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
The zero percent success rate only applies when Auto Mode is enabled in products like Claude Cowork. Auto Mode stacks two defense layers. The first layer scans incoming data for hidden instructions before the model processes them. The second layer blocks dangerous actions before execution. An attacker must beat both layers independently to succeed.
Without Auto Mode, Opus 5 has a 3.7 percent attack success rate, while Sonnet 5 performs better at 0.93 percent. Only the combination of the model and protective software pushes the rate to zero.
Background on Prompt Injection
Prompt injection has been a persistent security challenge for AI agents that interact with web content. Attackers can embed malicious instructions in web pages, emails, or other inputs that the AI processes, potentially causing it to perform unintended actions. The vulnerability is particularly concerning for browser-based AI agents that read and act on web content autonomously.
Anthropic's approach with Opus 5 combines model-level improvements with application-level defenses to address this threat. The company's system card provides detailed information about the model's capabilities and limitations.