Simon Willison (Jul 24): Opus 5 Is Anthropic's Least Prompt Injectable Model Yet

Main idea

Boris Cherny from Anthropic states in the Claude Opus 5 System Card (page 73) that the model is the most resistant to prompt injection attacks of all Anthropic models to date.

Context

Prompt injection — an attack where external content (email, webpage, document) can override AI agent instructions — is one of the most critical security threats for agentic AI systems. Simon Willison has long tracked and documented these attacks.

Why it matters

If accurate, Opus 5 could be a safer choice for production agentic systems processing untrusted input (emails, web scraping, third-party documents).

Details / arguments

• Quote Boris Cherny: 'Opus 5 is our least prompt injectable model yet...across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully'
• Source: Claude Opus 5 System Card, page 73
• Simon Willison shared the quote July 25, 2026 at 12:42 UTC
• Willison has long tracked prompt injection as a critical security risk in the LLM ecosystem