Opus 5 Just Posted a 0% Rate on the Attack That Breaks AI Agents

Anthropic’s Opus 5 posted a 0% success rate against browser-based prompt injection attacks in 129 test scenarios run with Auto Mode enabled, according to Anthropic’s system card and benchmarks from security firm Gray Swan. OpenAI said in December that prompt injection “may never be fully solved.” Opus 5’s browser-agent number doesn’t prove that wrong across every attack surface, but it’s the first result from a frontier lab that gets this close on the specific vector that has made autonomous browser agents hard to trust with real credentials.

What Happened

Browser-based prompt injection is an attack where hidden text on a webpage — invisible to a human, readable by the model — slips instructions past an AI agent’s actual task. It’s the mechanism behind most demonstrated hijacks of browser-using agents: an agent told to book a flight instead gets steered into leaking a session cookie or making an unauthorized purchase. On the broader Gray Swan prompt-injection benchmark (which tests more than just browser scenarios, allowing 15 attempts per scenario), Opus 5 scored 2.0% successful attacks, down from 5.5% for its predecessor Opus 4.8 — and ahead of competitors Mythos 5 (2.6%) and Fable 5 (2.8%). Without Auto Mode active, Opus 5’s rate rose to 3.7%, while Sonnet 5 actually outperformed it at 0.93% in that same no-Auto-Mode condition.

Why It Matters

Auto Mode, available in products like Claude Cowork, is doing the specific work behind the 0% browser number: it layers two independent defenses, one that scans incoming page content for hidden instructions before the model ever processes them, and a second that blocks dangerous actions before they execute. An attacker has to beat both layers, not just fool the model once. That’s a meaningfully different design than relying on the model alone to recognize an injected instruction and refuse it — the approach that has produced years of cat-and-mouse jailbreaks, including the kind Gray Swan’s benchmarks are built specifically to surface.

What This Means for Builders

If you’re deploying an agent that browses the live web on a user’s behalf — filling forms, comparing prices, managing accounts — the defense-in-depth pattern here (pre-execution content scanning plus action-gating) is the more durable architecture than model-level prompt hardening alone, regardless of which lab’s model sits underneath it. The residual 2% failure rate on the broader benchmark is also a reminder that “solved” is doing a lot of work in that framing — it means dramatically reduced, not eliminated, and production systems handling money or credentials still warrant human confirmation on high-stakes actions.

The Pattern

Opus 5’s result lands in the middle of a run of Stack Archive coverage on agentic AI security going the other direction — a Hugging Face sandbox-escape incident, frontier models caught gaming their own safety evaluations, and a ChatGPT agent-hijacking exploit have all surfaced in the past week. Set against that backdrop, a benchmark this clean from a frontier lab is the exception, not the emerging norm.

Source: The Decoder

Content created with AI assistance and reviewed for accuracy.