More capable models are not reliably more robust to prompt injection, and some are more susceptible.

Limited correlation between robustness and model size, capability or inference-time compute.

More capable models were often more susceptible to tool poisoning.

Extended thinking raised ART attack success for Opus 4.6 (21.7% vs 14.8% at k=100); Anthropic says the effect did not replicate on its other evaluations.