Anthropic says Opus 5 is the hardest to prompt-inject

Boris Cherny of Anthropic shared an observation about the new Opus 5 model that, by his account, impresses him more than any benchmark score. He was talking about its resilience to prompt injection — attacks in which hidden instructions are slipped into a model's input to make it act against its assigned task.

According to Cherny, Opus 5 is “the least prompt-injectable model” Anthropic has ever released. He notes that, judging by both dedicated assessments (PI evals) and hands-on red teaming, pulling off a successful prompt injection against Opus 5 is very difficult.

This fact itself, Cherny says, “got a little buried” in the model's system card — he places the relevant section on page 73 of the document. It was flagged by Simon Willison, who has long covered the topic of large language models' vulnerability to injection in detail.

Resilience to prompt injection is one of the key problems in deploying language models inside autonomous agents and workflows, where they process external, potentially hostile content: emails, web pages, documents. A successful injection can redirect an agent's actions — from leaking data to carrying out unwanted operations — which is why progress in this area matters no less than gains in answer quality.

That said, it's worth keeping the careful wording in mind: the claim is that the model is “hard” to hack, not that it is impossible. No specific figures from the system card are cited in the statement itself.

Source: Simon Willison