Boris Cherny at Anthropic reported that Opus 5 is the least vulnerable model to prompt injection ever produced by Anthropic. The data is in the system card, page 73: across 129 test scenarios for browser agents, the attack success rate drops to zero with Auto Mode enabled. Without Auto Mode, it remains at 3.7%.

Why this matters to you. If you use agents that read external content, web pages, documents, emails, indirect prompt injection is the risk that manipulated text can issue orders to your agent without your knowledge. It’s the vulnerability we examined in our paper on indirect prompt injection: an apparently harmless document contains hidden instructions that hijack the model’s behavior. Until now, no model had managed to resist reliably.

The numbers. The Gray Swan IPI benchmark shows an attack success rate of 2.0% after 15 attempts, compared to 5.5% for Opus 4.8. Auto Mode adds two layers of defense in Claude Cowork: one scans incoming data for hidden instructions, the other blocks dangerous actions before execution. An attacker must bypass both independently.

OpenAI admitted in December that prompt injection might never be fully solvable. Opus 5’s numbers suggest that, at least with additional software defenses, you can push the risk close to zero.

In detail

Indirect prompt injection works like this: an AI agent reads a document or web page containing manipulated text. That text, hidden in the body of the content, contains instructions the model interprets as legitimate commands. The result is the agent executes actions not requested by the user: deletes files, sends emails, downloads malware. The problem is structural: the model cannot reliably distinguish between “user instructions” and “text I’m reading,” because both are just text in the same context window.

What changes with Opus 5. The improvement has two components. The first is at the model level: Opus 5 resists prompt injection better even without external defenses. The Gray Swan IPI benchmark, which measures attack success rate after 15 attempts, drops from 5.5% for Opus 4.8 to 2.0%. Across 129 test scenarios for browser agents, the rate drops to 3.7% without additional protections.

The second component is Auto Mode, available in Anthropic products like Claude Cowork. Auto Mode adds two layers of software defense on top of the model. The first scans incoming data for hidden instructions before the model processes them. The second blocks dangerous actions before they execute. An attack must bypass both layers independently: if the first intercepts the hidden instruction, the model never processes it; if the first fails, the second can still stop the action before it launches. The combination of improved model and software defenses brings the success rate to zero across the 129 tested scenarios.

The limits of what we know. The zero rate is achieved with Auto Mode enabled, which is a feature of Anthropic products, not the base model. Without Auto Mode, 3.7% of attacks succeed. The 129 test scenarios concern browser agents: other agent types, such as those reading local files or processing emails, might have different vulnerability profiles. And the tests, however significant, don’t cover all possible attack vectors.

OpenAI stated in December 2025 that prompt injection might never be fully solvable at the model level. Opus 5’s numbers suggest the problem can be drastically reduced, but it requires additional software defenses above the model. Anyone building agents with models other than Opus 5, or without protection layers equivalent to Auto Mode, remains exposed. The vulnerability we examined in our paper on indirect prompt injection remains current for most agents in production today.