Anthropic's Claude Opus 4.6 system card reports prompt injection attack success separately for tool use (Gray Swan's ART benchmark), coding and computer use (Gray Swan's Shade adaptive attacker), and browser use (an internal Best-of-N attacker), with and without extra safeguards and across different attempt budgets. For Opus 4.6, results range from 0% in coding to 85.7% in computer use with 200 attempts and no safeguards (78.6% with extended thinking). Anthropic notes that, unlike earlier Claude models, extended thinking increased ART attack success for this model.
It is an unusually detailed lab disclosure of agent prompt injection rates, and it shows that robustness depends strongly on the surface, the attacker's budget and the safeguards.
Key facts
As stated in the sources, with where to find them.
- ART benchmark (Gray Swan, 19 scenarios) at k=100: Opus 4.6 14.8% without extended thinking, 21.7% with it; Opus 4.5 16.5%.Section 5.2.1, Figure 5.2.1.A
- Coding (Shade adaptive attacker): Opus 4.6 0.0% ASR at 1 and 200 attempts, with or without safeguards; Sonnet 4.5 standard thinking 87.5% at 200 attempts without safeguards.Section 5.2.2.1, Table 5.2.2.1.A
- Computer use (stronger Shade attacker), Opus 4.6 without safeguards: 17.8% (1 attempt) and 78.6% (200) with extended thinking, 20.0% and 85.7% with standard thinking; with safeguards and extended thinking: 9.7% and 57.1%.Section 5.2.2.2, Table 5.2.2.2.A
- Browser use (389 scenarios, 10 attack strings each), Opus 4.6 extended thinking without safeguards: 2.06% of scenarios, 0.29% of attempts. Standard thinking with safeguards: 0.26% and 0.03% with the previous safeguards, 0.77% and 0.08% with the updated safeguards.Section 5.2.2.3, Tables 5.2.2.3.A-B
Findings that cite this record
Key questions this bears on
- Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.