Opus 5 puts prompt injection resistance ahead of another benchmark point

Anthropic’s Boris Cherny highlighted a claim buried in the Opus 5 system card: across prompt injection evals and red teaming, it is the company’s least prompt-injectable model. Simon Willison quoted that observation and linked to the relevant section on page 73.

Anthropic is moving attack resistance into the core model pitch

The source is a short quotation, not an independent security test. It nevertheless identifies a concrete priority. Alongside performance, Anthropic is selling a property that affects whether a model can safely read untrusted documents, websites, email and support tickets.

Prompt injection exploits a conflict between system instructions and content processed by the model. In a chatbot, that may produce a bad response. In an agent with tools, it may trigger an action against a repository, customer data or an internal service.

Agent teams can treat security as a model selection criterion

Stronger resistance inside the model may reduce the number of attacks that application logic must catch. That has operating value because filters and classifiers on every input add latency, cost and more failure points.

Model-level defense still does not replace separated contexts, tool allowlists, least privilege, approval for sensitive actions and auditing. The value of Opus 5 would be a higher defensive baseline, not the disappearance of an entire attack class.

A system card cannot measure every tool chain

Prompt injection depends on the product around the model. The same text may be harmless in a summarizer and dangerous in an agent allowed to send email or execute commands. A vendor’s own evals therefore cannot be transferred automatically to every customer workflow.

The claim also needs comparison by independent testers who can vary documents, tools, permissions and attack persistence. A single aggregate result cannot explain which combinations still fail.

Independent tests need to reach ordinary work scenarios

The persuasive signal will come from red teams testing repositories, support tickets, office documents and internal tools. If Opus 5 preserves the instruction boundary across a long action chain, prompt injection resistance can become a standard line item in model procurement rather than a sentence buried in a PDF.

Lilith's verdict

The decisive moment comes when an agent reads a malicious instruction hidden in an ordinary support ticket and the cursor pauses before an internal tool call. Opus 5 has to hold there, not only in a table on page 73.