Opus 5's Most Important Upgrade Was Buried on Page 73: A 10x Lead in Prompt Injection Defense Over GPT-5.6

On the Gray Swan indirect prompt injection benchmark, attackers trying to hijack Claude Opus 5 succeed 2.0% of the time within 15 attempts. Against GPT-5.6 Sol, that figure is 20.0% 1. Boris Cherny at Anthropic called the prompt injection data more exciting than any of Opus 5's benchmark scores, and described it as "buried" on page 73 of the system card 2.

When an AI assistant reads a web page, processes an email, or opens a file, any of those inputs can carry hidden instructions designed to override its directives. A document that tells the model to ignore its original task and forward sensitive data to an external address is the scenario Gray Swan simulates, measuring how often an attacker succeeds within 15 attempts 1.

The results across models cluster by their maker. Opus 4.8, the model Opus 5 replaces, sat at 5.5%. Anthropic's Mythos 5 comes in at 2.6%. Opus 5 drops to 2.0%, a 64% reduction from its predecessor in a single generation. GPT-5.6 Sol sits at 20.0%, ten times Opus 5's rate 1. Two Anthropic models occupying the same low band while the OpenAI model sits an order of magnitude higher suggests injection resistance is a deliberate engineering target at Anthropic, not an incidental property.

When an agent has access to files, email, and APIs, the injection success rate is the property that determines whether it is safe to ship. At 20%, roughly one in five hijack attempts lands. At 2%, it is one in fifty. An agent that can be coerced one time in five into forwarding a file, calling an unauthorized API, or modifying a database record is a production liability regardless of its reasoning scores. Scale that across thousands of daily interactions and the gap between 2% and 20% becomes the difference between a controlled system and one that presents a persistent opening to attackers.

A second data set from the same system card reinforces the pattern. In browser-based environments run through Claude Cowork, attack success fell from 31.5% on Opus 4.8 to 3.70% on Opus 5, with no safeguards applied. With auto mode enabled, that figure reached 0% across all 129 test environments 1. Unlike the synthetic Gray Swan benchmark, the Cowork test runs in the browser environment where agents actually operate. A 31.5% baseline on the previous model shows how wide the exposure was in realistic scenarios. Opus 5 bringing that to zero with safeguards active is the kind of result that changes deployment decisions.

The injection resistance fits a broader pattern in how Anthropic built Opus 5. The company did not train the model on cybersecurity tasks, yet its ability to find vulnerabilities rose as a byproduct of general capability gains 1. Anthropic blocked exploit generation and binary-based scanning while allowing source-code vulnerability detection 1. The prompt injection numbers follow the same philosophy: harden the defensive surface deliberately, even when raw capability is climbing on its own.

Agents are now shipping with access to files, inboxes, and APIs. A model that scores higher on reasoning but can be hijacked one time in five gives an attacker more capabilities to exploit, not fewer. The system card files this data on page 73. For anyone deploying agents, it is the first page worth reading.