Opus 5 blocks browser prompt injection at 0% success rate with Auto Mode

Prompt injection has emerged as one of the hardest security problems in AI deployment, particularly for autonomous agents that must interact with web pages and user-controlled inputs. When an AI agent reads a webpage, an attacker can embed hidden text or crafted prompts that trick the model into ignoring its original instructions—for instance, stealing data or executing unintended actions. This vulnerability has been largely unsolved because it requires the model itself to reliably distinguish between legitimate input and malicious instruction, a task that becomes harder as attackers become more creative.

Anthropicís approach with Opus 5 addresses the problem not by claiming the model is immune, but by wrapping it in protective software (Auto Mode) that handles the problem at a different layer. The first layer catches hidden instructions before they reach the model, and the second layer prevents dangerous actions even if an injection succeeds. By requiring an attacker to defeat both independently, the combined system achieves near-perfect defense in real-world browser scenarios. This layered defense is important because, as OpenAI acknowledged in December, relying solely on the model's own robustness may not be sufficient.