Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-25 · high
Browser-agent attacks in Claude Cowork fell from 31.5% to 3.7%, and hit zero across all 129 test environments with Auto Mode on, per Boris Cherny.
Why now: Cherny flagged the number to Willison in a July 25 post, after the injection-resistance data got buried under Opus 5's headline eval scores at launch.
Opus 5 cut prompt injection attack success from 5.5% to 2.0% on the Gray Swan benchmark, Boris Cherny told Simon Willison.
Prompt injection is the flaw that lets a hidden instruction buried in a web page or email hijack an AI agent mid-task. It's the main reason teams hesitate to let agents browse or act on the open web unsupervised.
The number sits on page 73 of Opus 5's system card, left out of the launch highlights that focused on eval scores.
Anthropic's own browser-agent test in Claude Cowork showed a bigger drop: attack success fell from 31.5% to 3.7%. Turn on Auto Mode and it hit zero across all 129 test environments.
Cherny told Willison the injection numbers, not the evals, are the most exciting part of Opus 5 for him.
These numbers come from Anthropic testing Anthropic's model against Anthropic's own harness. Willison's post doesn't cite independent red-team results, and none are public yet.
Each link below shares sources, entities, or timing with this story.
Dario Amodei works at Anthropic / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Dario Amodei works at Anthropic); both cover AGI, Anthropic, ARC, Simon Willison; reported by the same outlet (simonwillison.net).
Claude benchmarked against Gray Swan / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude benchmarked against Gray Swan); both cover Anthropic, Opus, Simon Willison; reported by the same outlet (simonwillison.net).
Anthropic invested in Colossus / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Anthropic invested in Colossus); both cover Anthropic, Opus, Simon Willison; reported by the same outlet (simonwillison.net).
Opus built by Anthropic / Shared entities / Same source domain / Earlier coverage / Tension
Linked by a graph relationship (Opus built by Anthropic); both cover Anthropic, Opus, Simon Willison; reported by the same outlet (simonwillison.net).
Anthropic partners with OpenAI / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Anthropic partners with OpenAI); both cover AGI, Anthropic, ARC; overlapping topics (anthropic, architecture).
Anthropic partners with OpenAI / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Anthropic partners with OpenAI); both cover Anthropic, Simon Willison; reported by the same outlet (simonwillison.net).
Sam Altman supports Anthropic / Shared entities / Earlier coverage
Linked by a graph relationship (Sam Altman supports Anthropic); both cover AGI, Anthropic, ARC, Opus; earlier AGI coverage from 2026-03-29.
Boris Cherny works at Anthropic / Shared entities / Same source domain / Earlier coverage
Linked by a graph relationship (Boris Cherny works at Anthropic); both cover Anthropic, Boris Cherny, Simon Willison; reported by the same outlet (simonwillison.net).