Anthropic’s Claude Opus 5 has reduced successful indirect prompt injection attacks to 2% within 15 attempts, according to the company’s latest system card, marking the strongest result among models evaluated on the Gray Swan IPI benchmark.
Indirect prompt injection is a critical risk for AI agents that read emails, browse websites, process documents, or invoke tools. An attacker can hide malicious instructions within otherwise legitimate content, attempting to get an AI agent to execute them.
The potential impacts include sensitive data exfiltration, destructive actions, system compromise, and unauthorized financial activity.
Anthropic Claude Opus 5 Shows 98% Resistance
On the Indirect Prompt Injection (IPI) benchmark, Claude Opus 5 recorded a 2.0% probability that an attacker could achieve a successful compromise after 15 attempts. Put another way, it resisted 98% of attacks in that testing condition.
The result improves significantly on Claude Opus 4.8, where the attacker success probability reached 5.5% after 15 attempts. Opus 5 also reduced one-attempt attack success from 0.5% to 0.2%.
Anthropic said the 28-scenario IPI benchmark was created with Gray Swan, the UK AI Security Institute, the US Center for AI Standards and Innovation, and other model developers.
Anthropic described Opus 5 as the most robust model tested in the IPI evaluation. The company reported that the strongest non-Claude model, Muse Spark, had a 16.5% success rate within 15 attempts, more than eight times Opus 5’s reported 2.0% rate.
However, benchmark outcomes should be interpreted with caution: the results reflect a defined suite of scenarios and do not establish immunity to novel or deployment-specific attacks.
Anthropic also assessed Opus 5 against adaptive attackers rather than relying only on known prompt-injection datasets. This distinction matters because static benchmarks can overstate security when attackers can adapt payloads based on a target model’s responses.
In coding environments, Opus 5 achieved a 0.56% attack success rate with extended thinking enabled, down from 7.03% for Opus 4.8. Without thinking, its success rate was 0.41%, compared with 17.44% for the earlier Opus model.
The tests used Gray Swan’s Shade system, where an attacker could make up to 200 attempts per scenario across 40 scenarios.
Computer-use testing delivered similar gains. With extended thinking enabled, Opus 5’s attack success rate fell to 0.54%, versus 7.14% for Opus 4.8.
The model was compromised in at least one attempt in one of the 14 tested scenarios, highlighting that low attack success rates are not the same as complete resistance. Anthropic’s results emphasize that model robustness alone is insufficient for agent security.
The company uses prompt-injection probes to inspect incoming tool results for suspicious instructions, as well as classifiers that block potentially dangerous outbound tool calls.
When these probes were enabled, Opus 5’s coding-environment attack success rate fell to 0.18% in both tested configurations. In browser-use evaluations covering 129 curated environments, no successful attack was recorded against Opus 5 when its “auto mode” protections were active.
Those scenarios included attempts to trigger private-data theft, data destruction, system compromise, and unintended financial transactions.
The results suggest that Claude Opus 5 represents a material advance for organizations deploying AI agents in developer workflows, browser automation, and enterprise tool integrations.
Defenders should continue to apply least-privilege access, require confirmation for consequential actions, segment sensitive data, validate tool outputs, and maintain detailed logging.
Prompt injection remains a system-level security problem. A highly resistant model can reduce exposure, but secure deployment still depends on limiting what an agent can access and what it is authorized to do.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
