Anthropic’s Opus 5 shows measurable gains in resisting prompt injection attacks

Anthropic’s latest system card for Opus 5 reports measurable gains in resisting prompt-injection attacks, citing results from the IPI benchmark. The model reduces the probability of an attacker succeeding within 15 attempts from 5.5% with Opus 4.8 to 2.0% with Opus 5, and from 0.5% to 0.2% on the first attempt.

Opus 5 also outperforms other Claude family models evaluated on the same benchmark. Against Sonnet 5, attacker success drops from 5.9% to 2.0% at k=15, and against Mythos 5, it falls from 2.6% to 0.2% on the first try.

Among non-Claude models, Muse Spark is the strongest performer with a 16.5% success rate within 15 attempts, more than eight times higher than Opus 5’s 2.0%. The most capable GPT 5.6 variant, Sol, shows a 20.0% success rate within 15 attempts, comparable to its predecessor GPT 5.5 (20.8%), and is ten times more likely to be successfully attacked than Opus 5.

GPT 5.6’s other variants fare worse: Terra at 30.4% and Luna at 43.9% within 15 attempts. Even on a single attempt, Sol achieves a 3.1% success rate, exceeding Opus 5’s 2.0% rate after 15 attempts.

The post notes that preventing prompt injection in the general case is considered impossible with current architectures, but these results suggest incremental hardening against specific attack patterns is achievable.