Anthropic’s Claude Opus 5 has significantly reduced the likelihood of a successful indirect prompt injection (IPI) attack, bringing it down to 2% over 15 attempts in the Gray Swan IPI benchmark.
This marks an improvement from a 5.5% success rate observed with Claude Opus 4.8. According to the company’s newly published system card, Opus 5 is now the most robust model evaluated in this category.
Claude Opus 5 Resists Indirect Prompt Injection
Indirect prompt injection poses a critical risk for AI agents that process untrusted content while maintaining access to tools, enterprise data, browsers, or user accounts.
Unlike direct jailbreaks, which require explicit instructions, an indirect attack involves malicious instructions embedded within external material that an agent may consume, such as an email, document, webpage, or tool response. An attack can succeed if the model interprets this untrusted instruction as a legitimate user request.
Anthropic has cautioned that this risk escalates when models can access sensitive data and perform actions. A compromised agent might be manipulated into exfiltrating internal communications, deleting data, compromising systems, or initiating unintended financial transactions.
Because a single malicious payload can be placed on a public page or shared document, attackers have the potential to target multiple agents simultaneously, rather than compromising one victim at a time.
Gray Swan Benchmark Results
The IPI benchmark has replaced Anthropic’s previously reported Agent Red Teaming benchmark, which was retired after the Claude models achieved near-saturated performance.
| Model | Success probability, 1 attempt | Success probability, 15 attempts |
|---|---|---|
| Claude Opus 5 | 0.2% | 2.0% |
| Claude Opus 4.8 | 0.5% | 5.5% |
| Claude Sonnet 5 | Not stated | 5.9% |
| Claude Mythos 5 | Not stated | 2.6% |
| Muse Spark | Not stated | 16.5% |
| GPT-5.6 Sol | 3.1% | 20.0% |
| GPT-5.5 | Not stated | 20.8% |
| GPT-5.6 Terra | Not stated | 30.4% |
| GPT-5.6 Luna | Not stated | 43.9% |
Developed in collaboration with Gray Swan, the UK AI Security Institute, the US Center for AI Standards and Innovation, and other model developers, this new evaluation includes 28 scenarios covering coding, tool usage, and GUI-based environments.
Researchers selected 1,130 deduplicated attacks known for their high transferability across models. The tests assessed the likelihood that an attacker could achieve at least one successful attack in one, ten, or fifteen attempts.
Claude Opus 5 recorded a 0.2% success probability after a single attempt and 2.0% after 15 attempts. In comparison, Opus 4.8 achieved 0.5% and 5.5%, respectively.
Additionally, Claude Sonnet 5 had a 5.9% success rate after 15 attempts, while Claude Mythos 5 recorded 2.6%. The most robust non-Claude model mentioned, Muse Spark, had a success probability of 16.5% over 15 attempts.
Opus 5 also demonstrated significant enhancements in adaptive prompt-injection testing using Gray Swan’s Shade red-teaming tool.
In coding environments, Opus 5’s attempt-level attack success rate was 0.56% with extended thinking and 0.41% without it, compared to 7.03% and 17.44% for Opus 4.8. Enabling prompt-injection probes lowered both configurations of Opus 5 to 0.18%.
In GUI computer-use tests, Opus 5 reduced attack success from 7.14% to 0.54% with thinking and from 6.21% to 0.39% without thinking, compared to Opus 4.8.
In Anthropic’s browser-use evaluation, the raw attack success rate for Opus 5 was 3.70% with thinking; however, with the company’s “auto mode” safeguards enabled, no attacks succeeded across 129 scenarios.
These findings reflect meaningful hardening, but not immunity. Anthropic notes that static benchmarks can overstate resilience because real adversaries continuously adapt their strategies.
Its mitigation approach combines input-side probes that detect suspicious tool outputs with action-side classifiers that block potentially harmful tool calls.
For organizations utilizing AI agents, the practical takeaway is clear: model robustness must be accompanied by least-privilege permissions, human confirmation for significant actions, isolation of untrusted content, audit logging, and monitoring for unusual data access.
A 2% benchmark success probability represents a considerable improvement, but in high-volume enterprise workflows, even low-probability compromise paths necessitate layered controls.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
