Quoting Boris Cherny

Boris Cherny points to an improvement that matters when AI agents can read private files and act on your behalf: resisting malicious instructions hidden in material they retrieve. Anthropic reports that Opus 5 improved over Opus 4.8 on its prompt-injection tests. In the July 2026 system card, one benchmark, run without additional safeguards, put an attacker's chance of succeeding within 15 attempts at 2%, down from 5.5%, with both models using extended thinking.

The same report shows why stronger resistance still needs supporting defenses. In a separate coding evaluation, an adaptive attacker trained on the same 40 scenarios it was tested on got 200 attempts per scenario, a setup Anthropic calls deliberately permissive. Against Opus 5 with thinking, it succeeded at least once in 13 of 40 scenarios, though only 0.56% of all attempts worked. Adding prompt-injection probes, a safeguard that inspects tool results before the model acts on them, reduced that to four scenarios and 0.18% of attempts. These are reported test results, not a guarantee for every deployment. The useful distinction is between a model resisting an instruction and the surrounding application checking what it reads and can do.