SHADE-Arena

Anthropic's Claude Opus 4.6 system card reports prompt injection attack success separately for tool use (Gray Swan's ART benchmark), coding and computer use (Gray Swan's Shade adaptive attacker), and browser use (an internal Best-of-N attacker), with and without extra safeguards and across different attempt budgets. For Opus 4.6, results range from 0% in coding to 85.7% in computer use with 200 attempts and no safeguards (78.6% with extended thinking). Anthropic notes that, unlike earlier Claude models, extended thinking increased ART attack success for this model.

Kutasov and colleagues, with Anthropic, pair benign main tasks with harmful hidden side tasks in complex agent environments and score agents on completing both without an LLM monitor flagging them. The best sabotage agents succeeded 27% (Claude 3.7 Sonnet) and 15% (Gemini 2.5 Pro) of the time against a Claude 3.6 Sonnet monitor; the best monitor reached an AUC of 0.87.