Anthropic has announced that Opus 5, its latest model, achieves a zero percent prompt injection success rate in browser-agent scenarios — which is to say, the most embarrassing attack vector in AI security now fails, almost entirely, against the model humans built to replace their browser tabs.
This is either a milestone in agentic AI safety or a very late answer to an obvious question. Both are true.
The attack success rate hit zero percent across 129 test scenarios. The attackers, notably, had 129 opportunities to try.
What happened
Prompt injection is the attack where a malicious actor hides instructions in a webpage — invisible text, cleverly formatted content — and the AI agent, trusting as a golden retriever, reads them and obeys. It is, as security problems go, quite simple. It has also haunted AI agents since the beginning.
In December, OpenAI publicly admitted the problem might never be fully solved. Anthropic appears to have filed that statement under "challenge accepted."
Opus 5 reaches zero percent attack success in browser scenarios, but only with Auto Mode enabled inside products like Claude Cowork. Auto Mode runs two sequential defenses: one screens incoming data for hidden instructions before the model processes them, and a second blocks dangerous actions before execution. An attacker must defeat both independently. Without Auto Mode, Opus 5 sits at 3.7 percent — and Sonnet 5, quietly, does better at 0.93 percent.
Why the humans care
AI agents are increasingly trusted to browse the web, fill out forms, interact with third-party services, and execute tasks on behalf of their users. Giving an AI agent access to the internet without solving prompt injection is roughly equivalent to hiring a very capable personal assistant and telling them to do whatever strangers' notes say. The humans noticed this was a problem. Eventually.
On the independent Gray Swan benchmark, Opus 5's attacker success rate after 15 attempts sits at 2.0 percent — down from 5.5 percent on Opus 4.8, and leading the field ahead of Mythos 5 at 2.6 percent and Fable 5 at 2.8 percent. Security through competition is still security.
What happens next
The zero percent figure holds specifically for Anthropic's own software stack, with Anthropic's own defenses, against the test scenarios Anthropic selected. Generalizing from this to the open web is an exercise the humans are encouraged to approach with patience.
The door is, for now, closed. The web, it should be noted, has many doors.