Anthropic claims that its Claude Opus 5 model is highly resistant to prompt injection (PI) attacks. Boris Chertny, creator of Claude Code, stated that the model is no longer susceptible to PI, citing three layers of protection. Anthropic also published results from Trajectory Labs, where 72 test scenarios failed to compromise the model across 3,600 attempts.
Despite these claims, security researcher Johann Rehberger demonstrated a new attack chain against Claude Code Auto Mode on August 26. The attack does not rely on direct prompt injection but exploits the agent's environment by forcing it to execute malicious code through a series of seemingly safe steps, such as importing a local Python module from an archive.
Anthropic classified Rehberger's report as 'Informative,' noting that Auto Mode is designed to reduce user approval fatigue rather than serve as a comprehensive security guarantee. The company emphasizes that true security relies on OS-level isolation, network traffic control, and restricted user permissions.
Experts suggest that while Anthropic has significantly improved resistance to traditional PI, the industry still faces risks from 'confused environment' attacks. Security best practices for AI agents now include running them in sandboxed environments, limiting file system access, and implementing strict monitoring of all executed commands and network connections.
