Anthropic's Claude Opus 5 Hits 0% Prompt Injection Success Rate in Browser Agent Tests, With Defenses Enabled

The Numbers

Anthropic's newly published system card for Claude Opus 5 reports a 0% attack success rate against browser-based prompt injection across 129 test scenarios — but only when the model runs with Auto Mode enabled in products like Claude Cowork.

On a separate, broader benchmark run by security firm Gray Swan, Opus 5 recorded a 2.0% attacker success rate after 15 attempts on the Indirect Prompt Injection (IPI) benchmark, the lowest score among tested models. That's down from 5.5% for its predecessor, Opus 4.8. Two other frontier models tested on the same benchmark, referred to in Anthropic's materials as Mythos 5 and Fable 5, scored 2.6% and 2.8% respectively.

Why It Matters

Prompt injection is the attack where malicious instructions are hidden in web pages, documents, or other content an AI agent processes — text invisible to a human user but readable by the model, which can hijack the agent's behavior. As AI agents increasingly browse the web, fill out forms, and take autonomous actions, this attack vector has become the primary security concern blocking wider deployment.

The scale of the problem was underscored in December, when OpenAI acknowledged that prompt injection may never be fully solved — a notable admission from a company building agentic products. Anthropic's claim of a 0% success rate, even in a constrained test set, represents a meaningful data point against that pessimism.

The Catch

The zero-percent figure is not a property of the Opus 5 model alone. It requires Auto Mode, which stacks two independent defense layers: one that scans incoming data for hidden instructions before the model processes it, and a second that blocks dangerous actions before execution. An attacker must defeat both layers to succeed.

Without Auto Mode, Opus 5's browser agent attack success rate rises to 3.7%. Notably, Anthropic's own Sonnet 5 model performs better unprotected, at 0.93% — suggesting model-level robustness to prompt injection doesn't scale predictably with model size or capability tier, and that Opus 5's headline result depends heavily on surrounding infrastructure rather than raw model behavior.

What This Means

Anthropic's results suggest that solving prompt injection is currently a systems problem, not purely a model problem. The 0% figure is real but conditional — it describes a specific model-plus-software configuration under controlled test conditions, not an inherent property of Opus 5's weights. Enterprises deploying browser agents should treat Auto Mode (or equivalent layered defenses) as a requirement, not an optional add-on, until independent red-teamers replicate these results outside Anthropic's own testing environment. The Gray Swan benchmark, run by a third party, lends some external credibility to the improvement over Opus 4.8, but a 2.0% success rate after 15 targeted attempts is still nonzero — meaning determined attackers can and likely will find a way through in production settings at scale. The claim of having "solved" browser-based prompt injection should be read as a significant reduction in attack surface, not an absolute guarantee.