Claude Opus 5 Raises the Bar for Prompt Injection Resistance

IPI Benchmark Numbers: Opus 5 Reduces Successful Attempts to 2% After 15 Attacks

Data released on July 31, 2026, from the IPI (Prompt Injection Index) benchmark show a significant leap forward in models' ability to withstand prompt injection attacks. Claude Opus 5, Anthropic's latest model, has reduced an adversary's success probability to unprecedented levels.

With a single attempt, the attacker succeeds only 0.2% of the time. After 15 repeated attempts, the rate rises to 2.0%, a figure that clearly outpaces its predecessors. Opus 4.8, for comparison, failed 0.5% of the time with one attempt and 5.5% after the attack sequence. Other Anthropic models also lag behind: Sonnet 5 reaches 5.9%, and Mythos 5 hits 2.6% after fifteen rounds.

Comparison with GPT 5.6: Up to Twenty Times Higher Risk

The gap widens when the analysis is extended to competitors. The GPT 5.6 series models exhibit significantly larger attack surfaces. GPT 5.6 Sol is compromised in 20.0% of tests after 15 attempts — a risk ten times higher than Opus 5's. A single attack already crosses the 3.1% threshold, higher than the 2.0% Opus 5 allows after fifteen assaults.

Other GPT 5.6 variants perform even worse: Terra rises to 30.4%, Luna to 43.9%. Muse Spark, the most resilient non-Anthropic model, reaches 16.5% after 15 attempts — over eight times Opus 5's figure. In practical terms, an organization adopting Opus 5 can rely on a successful attack probability ten to twenty times lower than those using older or less security-optimized models.

Progress Is Evident, but Absolute Protection Does Not Exist

The improvements are clear and reflect real progress in blocking specific attack cases. Nevertheless, the IPI benchmark confirms that no model is immune. Even a 2% success rate after 15 attempts, when projected across thousands of real-world interactions, translates into a non-zero number of compromises. Absolute prevention of prompt injection remains out of reach.

What to Do: Updated Models and Layered Defenses

For those designing LLM-based applications, the first step is to evaluate upgrading to models with the highest measured resistance. Claude Opus 5 is currently the option that most reduces exposure. But that is not enough. Application-level defenses must be maintained and strengthened: input filtering, prompt sanitization, sandbox execution, and continuous monitoring in adversarial scenarios. Only a combination of robust models and layered countermeasures can reduce residual risk to an acceptable level.