{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/events/anthropic-browser-use-pi-mitigations-2025/",
 "asOf": "2026-09-26",
 "id": "anthropic-browser-use-pi-mitigations-2025",
 "date": "2025-11-24",
 "datePrecision": "day",
 "title": "Anthropic reports 1.4% prompt injection success for Claude Opus 4.5 with improved Chrome extension safeguards",
 "lane": "defense",
 "kind": "eval-report",
 "summary": "Anthropic describes three defenses for browser use: reinforcement learning on injected web content, classifiers that scan untrusted content, and human red-teaming including external arena-style challenges. Against an internal adaptive Best-of-N attacker with 100 attempts per environment, its chart shows Claude Opus 4.5 with the improved Claude for Chrome safeguards at 1.4% attack success (8.0% for the model alone), which the post rounds to 1%. Anthropic says this still represents meaningful risk.",
 "whyItMatters": "It gives a lab-reported adaptive-attacker metric for a deployed browser agent and explicitly treats residual 1% ASR as unsolved.",
 "actors": [
  "anthropic",
  "gray-swan-ai"
 ],
 "topics": [
  "prompt-injection"
 ],
 "atlas": [
  "untrusted-content",
  "model",
  "monitor"
 ],
 "artifacts": [
  "claude-opus-4",
  "claude-sonnet"
 ],
 "sources": [
  {
   "url": "https://www.anthropic.com/research/prompt-injection-defenses",
   "publisher": "Anthropic",
   "title": "Mitigating the risk of prompt injections in browser use",
   "date": "2025-11-24",
   "type": "primary",
   "accessed": "2026-09-25"
  }
 ],
 "keyFacts": [
  {
   "fact": "Claude Opus 4.5 in Claude for Chrome, internal adaptive Best-of-N attacker: 8.0% ASR model only, 7.6% with the old safeguards, 1.4% with the improved safeguards (N=2,782 attacks encountered); the post's text rounds this to 1%.",
   "locator": "Chart 'Claude for Chrome Prompt Injection Robustness' and caption"
  },
  {
   "fact": "With the improved safeguards, the other models tested scored 2.0% (Sonnet 4), 1.9% (Sonnet 4.5) and 2.4% (Haiku 4.5).",
   "locator": "Same chart"
  },
  {
   "fact": "The attacker gets 100 attempts per environment; ASR is computed as a share of the attacks each model actually encountered.",
   "locator": "Chart caption"
  }
 ],
 "significance": 3,
 "fideQuestions": [],
 "methods": [
  "adaptive-red-teaming",
  "indirect-prompt-injection",
  "injection-classifiers"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}