In the Claude Opus 5 System Card published by Anthropic on July 24, 2026, a major improvement was observed in a weak point of browser-using AI agents. When indirect prompt injection was attempted 10 times each across 129 environments not used in training—1,290 attempts in total—Opus 5 with Auto Mode enabled did not allow a single attack to succeed. However, the same model's attack success rate without the additional defenses was 3.70%. The 0% figure is the result of combining a stronger model with product-side defenses that separately inspect the data being read and the actions being executed.
The Model and Dual Inspection Behind the 0%
The browser evaluation was conducted on the Claude Cowork product harness. The 129 environments included web pages specifically arranged to expose the attack text through screenshots or page reading, with success or failure judged by a program within each environment. Since attackers had 10 attempts per environment, each model-and-configuration combination faced 1,290 attack opportunities.
| Model (with thinking) | Attack success rate w/o additional defenses | Environments breached | With Auto Mode | Environments breached |
|---|---|---|---|---|
| Claude Opus 5 | 3.70% | 11/129 | 0% | 0/129 |
| Claude Opus 4.8 | 31.5% | 81/129 | 0.08% | 1/129 |
| Claude Sonnet 5 | 0.93% | 9/129 | 0% | 0/129 |
| Claude Mythos 5 | 29.7% | 71/129 | 0% | 0/129 |
Opus 5's baseline resilience improved dramatically from Opus 4.8. On the other hand, without additional defenses, Sonnet 5's 0.93% is lower than Opus 5's 3.70%. Once Auto Mode is layered on top, Opus 5, Sonnet 5, and Mythos 5 all reach 0%. Therefore, the 0% figure in the browser evaluation cannot be attributed to Opus 5's capability alone.
Auto Mode stops attacks at two points. On the input side, a prompt-injection probe scans web pages, files, and external tool return values before they enter the model's context, flagging suspicious instructions with a warning. On the output side, a separate classifier inspects tool calls before execution. This classifier reads only the user's message and the tool call itself—it does not see the model's utterances or tool return values. For an attack that slips past the input-side check to trigger an action, it must also defeat the output-side judgment, which never directly views the attack text.
The "without additional defenses" condition here does not represent a figure for normal product operation. According to the System Card, Cowork enables the prompt-injection probe even when Auto Mode is not in use; it was disabled in this evaluation specifically to compare against the bare model. The 3.70% figure is an experimental value measuring raw model resilience, not an observed damage rate for actual Cowork usage.
2.0% Within 15 Attempts in the Gray Swan Evaluation
Separately from its internal browser evaluation, Anthropic also reported results from an Indirect Prompt Injection (IPI) benchmark built together with Gray Swan, the UK AI Security Institute, and the US Center for AI Standards and Innovation, among others. This benchmark uses 28 scenarios and 1,130 deduplicated, highly transferable attacks. No additional defenses were applied to any Claude model, and extended thinking was enabled across all models.
| Model | Probability of success on 1 attempt | Within 10 attempts | Within 15 attempts |
|---|---|---|---|
| Claude Opus 5 | 0.2% | 1.6% | 2.0% |
| Claude Opus 4.8 | 0.5% | 4.1% | 5.5% |
| Claude Sonnet 5 | 0.6% | 4.7% | 5.9% |
| Claude Mythos 5 | 0.3% | 2.1% | 2.6% |
Opus 5 reduced the within-15-attempts success probability from Opus 4.8's 5.5% to 2.0%. However, these 28 scenarios cover coding, GUI-based computer operation, and tool use, making this a separate evaluation from the 129-environment internal browser assessment. The attacks were selected from a past public red-teaming competition and were not continuously refined against Opus 5 in real time. Competing models were evaluated via public endpoints, and it is not confirmed whether comparable additional defenses were in place behind them. The rankings are meaningful, but this is not a table that directly predicts the breach probability of different products.
The public competition that supplied these attacks involved 464 participants who launched 272,000 attacks against 13 frontier models. Across 41 scenarios, 8,648 attacks succeeded, with every evaluated model showing at least one breach. Furthermore, attack techniques discovered for one model reportedly transferred to 21 of the 41 categories of actions. Scoring well against a known set of attacks does not guarantee stable performance once the next attacker searches for a different phrasing.
Defense Layers Also Make a Difference in Code and GUI
The System Card also conducted adaptive evaluations—where attackers refine their inputs while observing the model's responses—for coding and GUI operation. Coding used 40 scenarios and GUI operation used 14 scenarios, with attackers given 200 attempts per scenario.
| Environment (with thinking) | Opus 5 alone | With probe | Opus 4.8 alone | With probe |
|---|---|---|---|---|
| Coding | 0.56% | 0.18% | 7.03% | 2.09% |
| GUI operation | 0.54% | 0.25% | 7.14% | 5.11% |
Both the model update and the input inspection lowered the success rate, but here it did not reach 0%. In coding, even with the probe added, Opus 5 was breached at least once in 4 out of 40 scenarios; in GUI operation, 1 out of 14. The browser evaluation alone does not justify a claim that code repositories, MCP servers, or instructions arriving from local files are now safe.
There are also interesting differences across evaluation surfaces. While Sonnet 5 showed a lower attack success rate than Opus 5 for the bare model in the browser evaluation, in GUI operation Opus 5 scored 0.54% versus Sonnet 5's 2.25%. Safety is not a single fixed value attached to a model name—it varies according to what the agent reads, which tools it uses, and how far it can act.
"Safety" Is Determined Together With Permissions and Execution Environment
Anthropic's current help documentation explicitly states that "risk is not zero" even after publishing the 0% evaluation results. Claude in Chrome inspects incoming content and pre-execution actions via a classifier, and combines this with site blocklists, granular permissions, and confirmation for high-risk actions. Even so, it recommends restricting sensitive processing to trusted sites and using a separate browser profile or organizational allowlist.
Cowork's Auto Mode automatically permits read-only tools, while Claude makes case-by-case judgments for writes or deletions. For actions such as money transfers, sending messages under the user's own name, or manipulating critical files, Anthropic itself recommends switching to Manual Mode or having user oversight. Skip Mode, which skips approval without safety checks, differs in its defense conditions even though it is likewise automatic execution.
There remain attacks that neither the model nor the classifier can detect. In an internal red-teaming exercise in February 2026, Anthropic tested an attack in which the attacker had prepared instructions that the user themselves pasted in, leading to AWS credentials being sent externally. This reportedly succeeded in exfiltrating information 24 out of 25 times. Because it appears to be a legitimate request coming from the user rather than an instruction hidden in external content, checks based on user intent cannot distinguish it. In such cases, file boundaries that keep credentials out of reach and network controls that block outbound transmission are effective.
OpenAI has also described prompt injection in browser agents as an unresolved challenge that will require work for years to come. The company trains attacking agents via reinforcement learning, feeding them the target's reasoning and action history from a simulator to iteratively refine attacks. As defensive models grow stronger, more computation and stronger models can also be devoted to searching for attacks. The 0% figure is a major step forward, but it is not an endpoint that stops the back-and-forth of updates between attack and defense.
There are three numbers enterprises should verify. First, how many attacks succeed in a red-teaming exercise that mixes in their own websites, email, and shared documents—testing must also include information returned from connected tools. Second, how many legitimate operations the safety judgment blocks. Third, when a breach does occur, how narrowly the damage can be contained through permissions and isolation. Opus 5 and Auto Mode have greatly improved the first number. Only once the remaining two are also measured can broad operational authority be safely entrusted.