Opus 5 is being sold on prompt injection resistance, not just benchmark scores

Anthropic’s Boris Cherny highlighted a detail in Opus 5 that is easy to miss in normal benchmark talk: according to the system card, it is the company’s least prompt injectable model. Simon Willison quoted that point and linked it to the system card section on page 73.

Anthropic is moving agent safety into the Opus 5 pitch

The source is a short curated note, not a full product review. It makes one concrete claim: Cherny says Opus 5 is very hard to prompt inject successfully across PI evals and red teaming.

That is a different signal from a coding benchmark. Prompt injection is not a laboratory curiosity. It attacks the boundary between the user’s instructions, the system prompt and the external content the model reads.

For agents with tool use, that boundary is expensive. When a model reads documents, websites, tickets or email and can also call tools, weak prompt injection resistance turns a feature into an incident path.

Agent products need reliability before one more eval point

For developers building workflows on Claude or competing models, the practical point is simple. A model does not have to top every chart if it can be connected more safely to an environment where hostile text tries to steer it.

Teams often handle prompt injection above the model: filters, separated contexts, tool allowlists, manual approvals and audit trails. If part of the resistance improves inside the model, those layers still matter. They just stop carrying the whole load alone.

A system card is not an operating guarantee

The weak spot is obvious: a system card claim does not replace independent testing inside real products. Prompt injection is contextual, and attacks often emerge from the combination of a document, a permission model and badly designed tool use.

Opus 5 should not be treated as a shield that lets teams hand an agent every key. A better model raises the floor. Permissions, logging and intervention still belong to the product team.

Public red teams and production incidents will decide

The next signal will not be another table column. What matters is whether independent testers can break Opus 5 in ordinary agent scenarios: repository work, support tickets, change planning and internal tool calls.

If Anthropic’s claim holds outside its own evals, prompt injection resistance becomes a buying criterion. If not, Opus 5 remains a promising sentence buried in a PDF.

Lilith's verdict

The interesting part of Opus 5 may be the doorman, not the muscle. An agent that reads hostile text and touches tools first needs to ignore the sign taped to the wall telling it to do something stupid.