Claude Opus 5 Lowers Prompt Injection Benchmark Rate
Anthropic's Claude Opus 5 recorded a 2.0% indirect prompt injection attack-success rate after 15 attempts on August 10, 2026, in Gray Swan's IPI benchmark, according to its system card. Cybersecurity News reports that this improved on Claude Opus 4.8's 5.5% result under the same condition, while CyberPress notes that the benchmark covers defined scenarios rather than establishing deployment-wide immunity.
Anthropic's Claude Opus 5 recorded a 2.0% indirect prompt injection attack-success rate after an attacker received 15 attempts in Gray Swan's IPI benchmark, according to the company's newly published system card. Cybersecurity News and CyberPress report that the result was the lowest among the evaluated models under that test condition.
The reported 15-attempt result improved on Claude Opus 4.8, which recorded a 5.5% attack-success rate. In the single-attempt setting, Cybersecurity News reports that Opus 5's rate was 0.2%, compared with 0.5% for Opus 4.8.
Benchmark comparisons and scope
According to Cybersecurity News, Claude Sonnet 5 recorded a 5.9% rate after 15 attempts and Claude Mythos 5 recorded 2.6%. The same report lists Muse Spark, identified as the strongest non-Claude model in the evaluation, at 16.5%; GPT 5.6 Sol at 20.0%; GPT 5.6 Terra at 30.4%; and GPT 5.6 Luna at 43.9%.
CyberPress reports that Anthropic described the IPI benchmark as comprising 28 scenarios and developed with Gray Swan, the UK AI Security Institute, the US Center for AI Standards and Innovation, and other model developers. The source also reports additional coding-environment results: 0.56% attack success with extended thinking enabled and 0.41% without thinking, versus 7.03% and 17.44%, respectively, for an earlier Opus model. CyberPress describes a separate Shade-based test in which attackers could make up to 200 attempts per scenario across 40 scenarios.
What indirect prompt injection tests
Indirect prompt injection occurs when an AI system reads untrusted content, such as a webpage, email, or document, containing instructions intended to override a user's task or induce tool use. The risk is particularly relevant to agents connected to retrieval systems, enterprise documents, browsers, email, or action-taking tools. Cybersecurity News notes that stronger model behavior can lower the likelihood of malicious instructions changing an agent's decisions, but does not remove the underlying risk.
The benchmark result should not be read as a general security guarantee. CyberPress cautions that the figures reflect a predefined scenario suite and do not establish resistance to novel or deployment-specific attacks. In production, teams commonly combine model-level safeguards with least-privilege tool access, isolation of untrusted content, approval gates for consequential actions, and logging that can surface attempted instruction overrides.
For ML and security teams evaluating agentic systems, the 15-attempt metric is useful because it captures repeated adversarial interaction rather than a single prompt alone. Its operational value nevertheless depends on whether a deployment's tool permissions, retrieved content, and attacker access patterns resemble the benchmark's threat model.
Key Points
- 1Claude Opus 5 recorded a 2.0% 15-attempt IPI success rate, improving from Opus 4.8's reported 5.5% result.
- 2The Gray Swan result compares model behavior under defined attack scenarios, not security across every agent deployment or adaptive threat.
- 3Teams deploying tool-using agents commonly pair model defenses with least privilege, approvals, content isolation, and monitoring.
Scoring Rationale
The reported result is a notable security benchmark improvement for a frontier model. It is relevant to teams assessing prompt-injection exposure in agentic systems, though the evidence is limited to a defined benchmark rather than deployment-specific attacks.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
