Quoting Boris Cherny
Simon Willison's Weblog Simon Willison ● Covered by 17 sources
Anthropic says its new Opus 5 model is the hardest yet to trick with prompt injection attacks. That's a big deal since injection is one of the nastiest unsolved problems in AI security.
Based on reporting by Simon Willison's Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
Boris Cherny, who works on Anthropic's Claude Code team, dropped a quietly significant claim this week: Opus 5 is the company's most injection-resistant model to date. Not the flashiest headline you'd expect from a new frontier model launch, but arguably one of the more useful ones for anyone actually building things with these systems.
Prompt injection has been the industry's open wound since ChatGPT plugins first let models read untrusted text and then act on it. Feed a model a webpage, a PDF, or an email with hidden instructions buried inside, and there's a real chance it follows those instructions instead of yours. Every mitigation so far has been partial. Guardrails get bypassed, classifiers get fooled, and the arms race just continues.
Cherny's claim isn't marketing copy pulled from a press release. It points to page 73 of Opus 5's system card, where Anthropic apparently ran both automated PI evals and red-teaming exercises and came away with meaningfully better resistance numbers than prior Claude models. That's the kind of detail that tends to get buried under benchmark charts about coding and math, even though for a lot of real-world deployments, especially ones where a model is chewing through documents, browsing tools, or emails, injection resistance matters more than another point on a reasoning leaderboard.
The catch, as always with these things, is that 'hardest to prompt inject yet' is a relative statement, not an absolute one. Red teamers are creative, and attackers get to try again as many times as they want. Still, if Anthropic really has made structural progress here rather than just patching known attack strings, that's worth more attention than it's getting.
My take — AI-written commentary, not fact-checked reporting
I'll believe 'hardest model to prompt inject' when independent red teamers outside Anthropic take a real crack at it, because vendor-reported security wins have a bad track record of aging poorly. That said, burying this on page 73 instead of the top of the announcement tells you something about what actually gets rewarded in AI marketing right now, and it isn't safety.
Read more about this at: Simon Willison's Weblog