Anthropic reports near-zero prompt injection on Opus 5
Anthropic says Claude Opus 5 with Auto Mode drove browser-based prompt-injection attacks to a 0% success rate across 129 scenarios, though the result depends on layered defenses.
The hardest problem in agents
Anthropic is claiming meaningful progress on prompt injection — the class of attack in which malicious instructions hidden in webpage or document content hijack an AI agent's behavior. Widely regarded as the single biggest security obstacle to deploying agents that browse the web or read untrusted files, the problem was described by OpenAI as recently as December as one that may never be fully solved.
According to figures in Anthropic's Opus 5 system card, the model running with "Auto Mode" enabled recorded a 0% attack success rate across 129 browser-based test scenarios. On a broader prompt-injection benchmark run by the security firm Gray Swan, Opus 5 was compromised in 2.0% of attempts after 15 tries, ahead of Fable 5 at 2.8% and the earlier Opus 4.8 at 5.5%.
The caveats
The headline zero-percent figure is not an intrinsic property of the model. It requires both layers of Auto Mode working together: a pre-processing scan that flags hidden instructions, and an action-blocking step that halts risky operations before they execute. Stripped of those defenses, Opus 5's success rate rises to 3.7% — and, notably, Sonnet 5 performed better in isolation at 0.93%. In other words, the improvement is as much about the surrounding harness as the base model.
Why it matters
If the results hold up under independent testing, they mark the first time a frontier lab has claimed a near-complete defense against browser-based injection in a shipping product, rather than a research demo. That is directly relevant to the agent economy now forming around computer-use and coding agents, where a single successful injection can exfiltrate credentials or trigger unauthorized actions. The dependence on a defensive scaffold, however, tempers the claim: it suggests the industry's path forward runs through layered guardrails rather than a model that is inherently immune, and it leaves open how the defenses hold against adaptive attackers over time.