Anthropic's Opus 5 stopped browser prompt injections cold in 129 tests — zero successes

Anthropic claims it has effectively neutralized the most persistent security headache in AI agents: prompt injection. In a system card released alongside Opus 5, the company reports that its latest model, when paired with a defense layer called Auto Mode, fended off every single browser-based prompt injection attack thrown at it across 129 test scenarios. The attack success rate? Zero percent.

That number is hard to overstate. OpenAI’s own researchers admitted in December that prompt injection — where attackers hide malicious instructions in web pages or documents that an AI agent reads — may never be fully solved. For browser agents that can book flights, fill out forms, and move money around, the vulnerability has been an existential threat. Anthropic’s result suggests the problem is at least containable, if not solved outright.

The magic isn’t just in the model. Auto Mode stitches together two independent defenses: a pre-processing scan that catches hidden instructions before the model sees them, and an execution guard that blocks dangerous actions before they happen. An attacker has to beat both. Without those layers, Opus 5’s browser agent still gets tricked 3.7% of the time. Sonnet 5 actually outperforms it naked, at 0.93%. Only the model-plus-software combo drives the rate to zero. That detail matters — it means the safety comes from architecture, not raw model intelligence.

In a separate general prompt injection test run by security firm Gray Swan, the improvement was more incremental: Opus 5 fended off attacks 15 attempts in, with the success rate dropping from 5.5 percent in Opus 4.8 to 2.0 percent. So the model itself is tougher, but not invincible. The browser-agent result is the headline grabber, and it should be. For the first time, a lab has published a number that says, “This attack vector is closed in our product.” Whether that holds in the wild is the next question.