Simon Willison: Claude Opus 5 Is the Least Prompt-Injectable Model Yet

Main idea

Boris Cherny from Anthropic confirmed that Claude Opus 5 is the most resistant model to prompt injection in internal PI evaluations and red-teaming — a property critical for safely deploying AI agents in production environments.

Context

Prompt injection remains one of the biggest security threats for LLM agents. The ability of external content to 'hijack' an agent is a critical barrier to production deployment. This finding is included on page 73 of the Claude Opus 5 system card.

Why it's worth attention

Prompt injection resistance directly affects the trustworthiness of agentic systems. If Opus 5 genuinely resists these attacks much better, it opens the path to safer automated workflows.

Details / arguments

• Quote from Boris Cherny: 'Opus 5 is our least prompt injectable model yet... across PI evals and red teaming, Opus 5 is very hard to prompt inject successfully'
• Finding was 'a bit buried' in the system card — Simon highlighted it for the developer community
• Applies to scenarios where an agent encounters adversarial content in browsed pages, documents, or emails