Opus 5 vs Browser Prompt Injection: 0% Success Rate?

A 0% success rate across 129 test scenarios is a bold claim, but Anthropic is asserting that Opus 5 combined with Auto Mode has effectively neutralized browser-based prompt injection. For those of us who enjoy watching LLM agents get hijacked by a random hidden string of text on a webpage, this is either a massive win or the end of an era of chaotic fun.

Without the "Auto Mode" protection layers, the injection success rate sat at 3.7%. While that seems low, in a real-world AI workflow, a 3.7% chance for a malicious website to hijack your agent's session and steal data is an absolute nightmare for any enterprise deployment.

The technical win here isn't just about the model being "smarter," but about how the system handles the boundary between external web data and internal instructions. Most AI agents are gullible—they see a command on a page and assume it's a divine directive from the user. If Opus 5 actually cracked this, it means we're moving toward agents that can actually browse the web without accidentally handing over the keys to the kingdom because a website told them to "ignore all previous instructions."

It'll be interesting to see if this holds up once the community starts stress-testing it with more creative, adversarial prompts. Until then, it looks like the "ignore previous instructions" meme is finally losing its power.