Anthropic reports that its latest model, Opus 5, is nearly immune to prompt injection attacks within its own software ecosystem. Prompt injection—a technique in which an attacker circumvents an AI model's operating instructions through manipulated inputs such as hidden text embedded in web pages—failed against Opus 5 in almost every tested scenario.

According to the Opus 5 System Card, the attack success rate for browser agents reached zero percent across 129 test scenarios. This stands in notable contrast to OpenAI's acknowledgment in December that prompt injection may never be fully solved.

In a general prompt injection evaluation conducted by security firm Gray Swan, the success rate after 15 attempts dropped from 5.5 percent on Opus 4.8 to 2.0 percent on Opus 5, as detailed in the system card's security testing section.

However, the zero percent browser-agent result depends on enabling Auto Mode in products such as Claude Cowork. Auto Mode deploys two layered defenses: one that scans incoming data for hidden instructions before the model processes them, and another that blocks dangerous actions before execution. An attacker would need to independently defeat both layers to succeed.

Without these protections, Opus 5's prompt injection susceptibility sits at 3.7 percent. Interestingly, Sonnet 5 performs better in that unprotected configuration, with a rate of 0.93 percent. Only the combination of the Opus 5 model and the Auto Mode protective software pushes the attack success rate to zero in browser-agent scenarios.

Prompt injection has been widely regarded as one of the most significant security challenges facing AI agents—autonomous systems that browse the web, read documents, and take actions on behalf of users. Because these agents routinely process untrusted external content, malicious actors can potentially embed instructions that override the agent's original directives. The vulnerability has been a persistent concern across the AI industry and a key obstacle to the broader deployment of agentic AI systems. Major AI labs including Google and OpenAI are also developing browser-agent products, making prompt injection resistance a competitive differentiator as these tools move toward wider consumer and enterprise use. Anthropic's results suggest that combining model-level training improvements with architectural guardrails can reduce risk, though the findings apply specifically to Anthropic's own ecosystem and may not generalize to third-party deployments that lack equivalent layered defenses.