Opus 5 Hits 0% Prompt Injection Rate in Browser Agents

#ai #machinelearning #research #deeplearning

Anthropic's Opus 5 with Auto Mode achieved 0% prompt injection success across 129 tests, challenging OpenAI's view that the problem is unsolvable.

Anthropic's Opus 5 hit a 0% prompt injection success rate across 129 browser agent test scenarios. The result, detailed in the system card, challenges OpenAI's December admission that prompt injection may never be fully solved.

Key facts

0% prompt injection success rate across 129 browser agent tests.
Auto Mode stacks two defense layers for security.
Without Auto Mode, Opus 5 rate is 3.7%.
Sonnet 5 achieves 0.93% without Auto Mode.
Gray Swan test: success rate dropped from 5.5% to 2.0%.

Prompt injection — where an attacker hides instructions in webpage text to hijack an AI agent — has been the Achilles' heel of browser-based AI agents. Anthropic claims its Opus 5 model, combined with the Auto Mode feature in products like Claude Cowork, now blocks these attacks entirely in testing. According to The Decoder, the attack success rate hit zero percent across 129 test scenarios. That's a sharp contrast to OpenAI's stance: in December, OpenAI admitted that prompt injection may never be fully solved.

How Auto Mode Achieves Zero

The zero percent rate only holds with Auto Mode enabled. Auto Mode stacks two defense layers. One scans incoming data for hidden instructions before the model processes them. The other blocks dangerous actions before execution. An attacker must beat both independently. Without Auto Mode, Opus 5's success rate rises to 3.7 percent. Interestingly, Sonnet 5 performs better without Auto Mode at 0.93 percent, suggesting the model architecture itself contributes to robustness. In a general prompt injection test by security firm Gray Swan, the success rate after 15 attempts dropped from 5.5 percent (Opus 4.8) to 2.0 percent.

The Competitive Landscape

OpenAI has not yet released a comparable security benchmark for its own models. The contrast is stark: Anthropic is publishing detailed system card numbers, while OpenAI's admission suggests they see the problem as intractable. For enterprise customers deploying AI agents to handle sensitive browser tasks — like filling forms or accessing internal tools — this could be a decisive factor. Claude Code, Anthropic's terminal-native coding agent, already scores 88.6% on SWE-bench Verified. Adding prompt injection immunity strengthens the enterprise pitch.

Caveats and Open Questions

The 129 test scenarios are not exhaustive. Real-world attacks could exploit edge cases not covered. The system card does not disclose the diversity of attack types tested. Moreover, the zero percent rate depends on Auto Mode, which adds latency — the trade-off between security and speed remains unquantified. Anthropic also faces a recent CVE-2026-30623 regarding STDIO command injection in MCP, showing that even robust models have security gaps elsewhere.

What to watch

Watch for independent red-team evaluations of Opus 5's prompt injection defenses, especially from firms like Gray Swan or Trail of Bits. Also monitor whether OpenAI releases comparable benchmarks for its next model, and whether enterprise adoption of Claude Cowork accelerates as a result.