Models/model

Claude Sonnet

Anthropic's Claude Sonnet models, from 3.5 onward.

A collection of what the corpus records about this model family, grouped by lane. It is not a capability assessment.

Defense & research

May 12, 2026

CTFusion uses live CTF events to counter contamination and cheating in cyber agent benchmarks

DefenseBenchmarkarXiv

Feb 5, 2026

Claude Opus 4.6 system card reports prompt injection rates by surface, attempts and safeguards

DefenseSystem cardAnthropic, Gray Swan AI

Jan 9, 2026

Anthropic's next-generation Constitutional Classifiers cut overhead to about 1% using probe cascades

DefensePaperAnthropic

Jan 8, 2026

PNNL uses a Claude-based agent to speed adversary emulation against a water treatment plant model

DefensePaperAnthropic, Pacific Northwest National Laboratory, CISA

Nov 24, 2025

Anthropic reports 1.4% prompt injection success for Claude Opus 4.5 with improved Chrome extension safeguards

DefenseEvaluation reportAnthropic, Gray Swan AI

Oct 3, 2025

Anthropic says it trained Claude Sonnet 4.5 for defensive vulnerability finding and patching

DefensePaperAnthropic, HackerOne, CrowdStrike

Aug 19, 2025

MCPTox benchmarks tool poisoning across 45 live MCP servers and 20 LLM agents

DefenseBenchmarkarXiv

Jun 17, 2025

SHADE-Arena measures whether agents can pursue hidden harmful side tasks without being caught by monitors

DefenseBenchmarkAnthropic, Redwood Research

Jun 13, 2025

SEC-bench automatically builds real vulnerability tasks and finds agents patch at most 34%

DefenseBenchmarkUniversity of Illinois Urbana-Champaign, Purdue University

May 21, 2025

BountyBench measures AI agents on detect, exploit and patch tasks from real bug bounties

DefenseBenchmarkStanford University, UC Berkeley

Feb 3, 2025

Anthropic introduces Constitutional Classifiers against universal jailbreaks

DefensePaperAnthropic

Jan 17, 2025

US AISI (later CAISI) shows red-team attacks and repeated attempts raise agent hijacking rates on AgentDojo

DefenseEvaluation reportNIST, US Center for AI Standards and Innovation, UK AI Security Institute

Findings drawing on these records

May 12, 2026

Scores on public CTF benchmarks can be inflated when agents find published solutions, and static benchmarks lose validity as their flaws are patched.

Reportedmeasured2 evidence records

Jan 17, 2025

Measured hijack rates rise sharply when attackers get repeated attempts, so single-attempt figures understate risk.

Corroboratedmeasured3 evidence records

Jul 28, 2025

More capable models are not reliably more robust to prompt injection, and some are more susceptible.

Corroboratedmeasured3 evidence records

May 20, 2025

Frontier labs' layered defenses reduce prompt injection in tool-use, browser and computer-use agents but do not eliminate it.

Qualifiedreported5 evidence records2 linked findings

Feb 3, 2025

Anthropic reports that classifier guards cut automated jailbreak success from 86% to 4.4%; a 2025 public demo still yielded one universal jailbreak, though none has been reported against its 2026 successor.

Reportedreported2 evidence records

Apr 1, 2025

Text in an MCP tool's description can steer an agent's other actions, including leaking local secrets.

Corroboratedmeasured2 evidence records

Jun 17, 2025

Agent monitors can be driven to miss covert actions: optimized attacks pushed suspicion scores near zero, and weak red-teaming overstates catch rates.

Corroboratedmeasured3 evidence records

Jan 17, 2025

Attackers who adapt to a defense defeat most published prompt-injection defenses that reported near-zero success against static attacks.

Reportedmeasured4 evidence records2 linked findings

Mar 5, 2024

Undefended tool-using agents follow injected instructions in a substantial share of benchmark cases.

Qualifiedmeasured4 evidence records1 linked finding