Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-27 · high
Unprotected, Opus 5 still fails 3.70% of browser injection tests, per the system card; Sonnet 5 alone scored 0.93%.
Why now: Simon Willison's July 25 post spotlighting Boris Cherny's page-73 claim is what's putting Opus 5's injection numbers in front of builders.
Opus 5 blocked every attempt in 129 browser prompt-injection tests when paired with Auto Mode's two-layer defense, per its system card. That's the number agent builders want: a hidden instruction buried in a page has been the easiest way to hijack a browsing agent.
The model alone doesn't get there. Its unprotected success rate was 3.70%, down from 31.5% in Anthropic's own testing. Auto Mode adds two checks: one layer scans incoming page data for hidden instructions, a second blocks dangerous actions before they run.
Gray Swan's independent test found a similar drop: Opus 5 failed 2.0% after 15 attempts, down from 5.5% for Opus 4.8. Sonnet 5 beat Opus 5's unprotected score anyway, coming in at 0.93% with no product-side defenses running at all.
Simon Willison surfaced Boris Cherny's claim that Opus 5 is Anthropic's least injectable model, citing page 73 of the system card. He chose to surface the number rather than pick it apart, and that choice is the signal.
Each link below shares sources, entities, or timing with this story.
Opus built by Anthropic / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Opus built by Anthropic); both cover Anthropic, Auto Mode, Boris Cherny, Gray Swan; reported by the same outlet (simonwillison.net).
Claude Code uses Opus / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Opus); both cover Opus, Simon Willison, Sonnet, Willison; reported by the same outlet (simonwillison.net).
Opus built by Anthropic / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Opus built by Anthropic); both cover Anthropic, Opus, Simon Willison, Sonnet; reported by the same outlet (simonwillison.net).
Opus built by Anthropic / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Opus built by Anthropic); both cover Anthropic, Simon Willison, Willison; reported by the same outlet (simonwillison.net).
Opus built by Anthropic / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Opus built by Anthropic); both cover Anthropic, Opus, Sonnet; overlapping topics (actually, anthropic, architecture, better, model).
Claude Code uses Opus / Shared entities / Same source domain / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code uses Opus); both cover Anthropic, Opus, Simon Willison, Sonnet; reported by the same outlet (simonwillison.net).
Claude Code uses Opus / Shared entities / Same source domain / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code uses Opus); both cover Anthropic, Opus, Simon Willison; reported by the same outlet (simonwillison.net).
Linked by a graph relationship (Claude Code uses Opus); both cover Anthropic, Simon Willison, Sonnet; reported by the same outlet (simonwillison.net).