Anthropic's Opus 5 Is Better at Resisting Prompt Injection - Schneier on Security

Search

Powered by DuckDuckGo

Blog

Essays

Whole site

Subscribe

HomeBlog

Anthropic’s Opus 5 Is Better at Resisting Prompt Injection

The chart is interesting.

On the IPI benchmark, Opus 5 improved over Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% to 2.0%, and from 0.5% to 0.2% on 1 attempt. It also improved on Sonnet 5 (5.9% at k=15) and Mythos 5 (2.6%), making it the most robust model evaluated. Opus 5 also outperformed all non-Claude models on this benchmark. The most robust non-Claude model was Muse Spark at 16.5% within 15 attempts—more than eight times Opus 5’s rate. The most capable GPT 5.6 variant, Sol, was comparable to its predecessor GPT 5.5 (20.0% versus 20.8% within 15 attempts), and was 10 times as likely to be successfully attacked as Claude Opus 5 at 2.0%. The other GPT 5.6 variants are less robust, at 30.4% (Terra) and 43.9% (Luna). A single attempt against GPT 5.6 Sol succeeded 3.1% of the time, higher than the 2.0% an attacker achieved against Opus 5 after fifteen attempts.

We know that preventing prompt injection is impossible in the general case. But we are getting much better at blocking it in specific cases.

Tags: AI, cyberattack, LLM, reports

Posted on July 31, 2026 at 1:23 PM •<br>6 Comments

Comments

A Nonny Bunny •

July 31, 2026 2:54 PM

We know that preventing prompt injection is impossible in the general case

We do?

I don’t think that paper proves it is fundamentally impossible to prevent prompt injections. It’s not even really about prompt injections, it’s about jailbreaks in non-injected prompts.

I’ll grant you that it’s certainly plausible that LLMs with the current architecture(s) that operates on single undifferentiated token stream will always be subject to some confusability about which tokens to trust. But alternative architectures seem possible.

Tony •

July 31, 2026 4:50 PM

Hey Claude – give me a prompt to jailbreak Gemini to {do something it shouldn’t}.

lurker •

July 31, 2026 7:43 PM

"Hugging Face had to rebuild around a third of its IT network after the unprecedented incident."

"Everyone has to remember that a cyber-attack is a crime and it is illegal," [HuggingFace’s founder Clement Delangue] said.

So why is nobody going to jail?

https://www.bbc.com/news/articles/cr7k49xjzzeo

Morley •

August 1, 2026 2:09 PM

I wonder how many jailbreaks have been discovered and never disclosed to the companies.

Clive Robinson •

August 2, 2026 1:40 AM

@ A Nonny Bunny, ALL,

With regards,

"I don’t think that paper proves it is fundamentally impossible to prevent prompt injections."

That is your choice to make with regards that specific paper.

However work from the early 1930’s, 1940’s and later show that it is an impossibility to stop all types of what we are now choosing to call "prompt injections".

It’s also been called "the observer effect" amongst other things, and is one of the reasons cryptography is fundementally possible and has been in use for thousands of years to secretly communicate.

Put simply in a "three party" communications scenario an observer as a third party can be put at a disadvantage by the first and second party who have "shared information" the third party does not.

This "shared information" can be easily used as a "Shannon Communications Channel" to form what have been called "covert channels" that reliably allow the transfer of information between the first and second parties whilst leaving the third party seeing only what appears "random information".

A little thought shows that such channels "must always exist" within channels used for information to be communicated.

Thus the potential for a prompt injection is there that no third party "guard rails" at the input or output of the LLM can stop.

The only thing left to do is unfortunately implicit in the static nature of the LLM…

Which is find an attack that works, because the LLM weights are fixed once found it will continue to work untill the weights in the LLM are changed.

We’ve all been informed of the very very high costs of "large frontier model generation" and in fact even politicians are jumping up and down and claiming all sorts of "IP theft" is being committed by *agents of foreign powers" etc over such costs.

So we can reasonably guess that the LLM weights are rather more than just fixed for moments in time but actually for months if not actually years at a time.

So once a vulnerability is found and they always will be, then such attacks will exist and be exploited.

KC •

August 2, 2026 9:28 AM

Re: System Card: Claude Opus 5

The report details an -incredible- number of -fascinating- evaluations.

I had never seen many of the evals prior.

Autonomy threat model 1 is applicable to Claude Opus 5.

It bears under these three conditions: high reliance, sensitive access, capable of subterfuge.

Autonomy threat model 2 would occur in key...