Opus 5 and Auto Mode Report Zero Prompt Injection Success in Browser Agent Tests

Anthropic says Opus 5 is nearly immune to prompt injections in its own software, according to The Decoder. In browser-agent testing, Opus 5 combined with Auto Mode reached a zero percent prompt injection success rate across 129 scenarios. Without those added protection layers, the reported success rate was 3.7 percent.

Prompt injection happens when an attacker slips instructions into manipulated inputs, such as hidden text on a webpage, to bypass an AI model’s intended instructions. That is especially important for browser agents because they read and act on web content. If the reported results hold up in real-world use, they could address a major security concern for agents operating in browsers.

The zero percent result only applies with Auto Mode enabled in products such as Claude Cowork. The report says Auto Mode combines two defenses: one scans incoming data for hidden instructions before the model processes it, and the other blocks dangerous actions before execution. The attacker would need to defeat both independently, making the combined setup stronger than the model alone.

In a broader prompt injection test by security firm Gray Swan, the success rate after 15 attempts dropped from 5.5 percent for Opus 4.8 to 2.0 percent for Opus 5. The Decoder also notes that Sonnet 5 scored 0.93 percent without the same browser-agent protection stack, while Opus 5 alone sat at 3.7 percent. The practical takeaway: the strongest result comes from pairing the model with protective software, not from the model by itself.