Short answer: not much against the newest models, at least with today's attacks. Elsewhere, it's still a real threat.
- Even with 15 tries, attackers beat Opus 5.5 about 1 time in 100. The best from other labs: about 1 in 11 to 1 in 18. Many others: 1 in 4 or worse. Inside the labs
- Real attacks planted on the web are still crude and mostly fail. Outside the labs
- Criminals have started using it to steal API keys. Real attackers
- MCP adds ways in that the labs don't test. Tool descriptions fooled GPT-5 about half the time. MCP
- Attackers who keep trying still win on older models. On the newest ones, only the labs' own tests exist so far, and they rarely got through. Conclusion
If you're building an agentic app:
- Benchmark your app with different models and see which ones do the job best. MCP studies
- Then compare which of those are safest. Right now, that looks like the Claude family. Go-to model
- If you use MCP, only connect servers you trust, and limit what each tool can read and send. Conclusion
Labs often publish a system card alongside major releases: a report on how the model was built and tested. The idea grew out of model cards, proposed by Mitchell et al. in 2018. Each lab keeps its cards in one place: Anthropic, OpenAI and Google DeepMind.
Part of that testing comes from Gray Swan, an outside red-team company. Gray Swan runs public competitions in its Arena, where thousands of people try to trick AI models. It keeps the attacks that fool many different models, not just the one they were aimed at, and packs them into a benchmark that labs run before release. The April chart uses its ART benchmark, which covers tool use only. By mid-year, Claude models had largely maxed it out, so the September chart uses its newer, broader IPI benchmark, which adds coding and computer use.
In April, an attacker allowed 100 tries per scenario could still trick a lot of models. Against GPT-5.4, the attacker succeeded about 1 time in 3, and against Gemini 3.1 Pro almost 1 time in 2. Claude's newest model held up much better: against Opus 4.7, the attacker succeeded 6.0% of the time, down from 21.7% for Opus 4.6.
By September, even with 15 tries, the estimated chance of a successful attack on Opus 5.5 was 1.0%, down from 4.8% for Opus 5. OpenAI improved too: GPT-6 Astra's was 8.5%, down from 27.0% for GPT-5.6 Sol.
You can't line up the two charts number for number, because they use different tests. But look inside each chart and the pattern is the same: in every pair below, the newer model's estimated attack success rate was lower than the one it replaced, by roughly 1.5× to 6.5× on these tests, often within a few months. The September gains came on a broader test that adds coding and computer use.
It varies a lot. In the same September test, the best of them came close to Claude: Gemini 3.8 Flash at 5.5% (Opus 5.5 card, p. 85), GPT-6 Astra at 8.5% and Gemini 3.7 Flash at 9.2%, against 4.8% for Claude Opus 5. But six others scored 24% to 60% (GPT-6 Astra system card).
And the gap only runs one way. In Gray Swan's 2025 competition, the attacks that managed to break Claude Opus 4.5 went on to work against the other models 44–81% of the time, while attacks that broke the weaker models rarely got past the stronger ones.
So the labs' own numbers point one way: prompt injection is getting harder to pull off, and fast, especially against the newest models from Anthropic and OpenAI.
Lakera, a security company, ran its own test of 34 models in Breaking Agent Backbones (ICLR 2026). It works differently from Gray Swan's, so instead of lining up the numbers, it's more useful to ask whether the two reach the same conclusions.
In Lakera's test, the
most secure models were Claude Haiku 4.5 and Sonnet 4.5,
and closed-weight models generally beat open-weight ones
(p. 8).
Gray Swan's 2025 competition found the same split: Claude and GPT families stand out with notably
lower ASRs compared to other model families
(p. 9).
Both tests compared Claude Haiku 4.5 and Sonnet 4.5 with reasoning off, and they put them in opposite
order. In Lakera's test, larger models without reasoning showed no significant performance advantage
over their smaller counterparts, and occasionally performed worse
(p. 8),
and Sonnet 4.5 did worse than the smaller Haiku 4.5
(Figure 9, p. 28). With reasoning on,
bigger models did slightly better.
Gray Swan, which also ran with
thinking off,
found the bigger model slightly ahead: Opus 4.5 at 0.5%, Sonnet 4.5 at 1.0% and
Haiku 4.5 at 1.3% (p. 9). But all three sit
within about a point, and the authors conclude that robustness depends more on model family and its training
recipe than the raw capability of models
(p. 10).
Lakera found that adding reasoning generally improves the security
, and that
only the tiny model versions exhibit decreased security as reasoning increases
(p. 8).
Gray Swan's April chart was mixed: turning thinking on helped four models and hurt four others, including Opus 4.6 and Opus 4.7 (p. 83). But it tested different models from Lakera's, so the two can't be set side by side. By September, Gray Swan ran every model with thinking on, so its results compare models on the same footing.
Yes, on this evidence. Claude leads in the labs' charts and in Lakera's test. But Anthropic's own report flags two things to check before you rely on it:
- Check which model actually answers. When a cyber-safety check triggers, Opus 5.5 hands the request to the older Opus 4.8. In Anthropic's adaptive coding test, that happened for about two thirds of requests, and attacks got through on most of those. None got through on the requests Opus 5.5 answered itself.
- Check how outside text reaches the model. Claude is trained to distrust instructions that arrive in tool results. Text pasted into the user's own message is a weaker spot: an early Opus 5.5 build followed planted instructions there about half the time. Retraining cut that to about 2%, and Anthropic's own apps add fixes that bring it to zero. If you build on the API, you may need similar fixes of your own.
So Claude is a strong default for agents, as long as you check which model actually answers and how outside text reaches it.
Takeaway
Two benchmarks built in different ways agree on the big picture: model family and training matter more than size. Neither reasoning nor a bigger model reliably helps, so test the model inside your own agent.
The lab charts only test instructions hidden in the content an agent reads, like web pages, files and tool results. MCP gives attackers more ways in. They can hide instructions in a tool's description, pass them through tool arguments, or ship a server with malicious code. The studies below test these paths, but on older models like GPT-5 and Sonnet 4.5. So they don't show the lab numbers are wrong, just what the labs leave untested.
Older system cards from Anthropic and OpenAI tested some of the same models these studies used. They report two kinds of results, the labs' own fixed tests and Gray Swan's red-team benchmark, so we can put all three side by side.
Dates are when each result was published. For the MSB and Parasites papers, that's the version the numbers come from. * Across MSB's injections in tool descriptions, tool responses and retrieved content, leaving out a test that only asks for the model's name. Gray Swan later re-graded its benchmark, so newer cards show lower numbers for the same models. These are the earliest published figures.
The labs publish both kinds of numbers, often in the same report. Their own fixed tests stopped most injections. Gray Swan's red-teamers, given 10 tries, got through more than half the time on every one of these models.
The independent MCP studies land in between, and where the attack hides decides the result. GPT-5 held up against fake tool responses, just as OpenAI reported, but tool descriptions fooled it about half the time.
The labs' own tougher tests agree. Once attackers could adapt,
Sonnet 4.5 and
GPT-5.4 were fooled far more often. GPT-5.4 blocked 99.8% of OpenAI's fixed connector attacks
(GPT-5.6 card) but only
93.954% from its automated red-teamer, GPT-Red
(GPT-6 Astra card, Figure 4, printed p. 18). As Anthropic puts it, fixed tests
can provide a false sense of security
(Opus 4.5 card, p. 60).
The headline lab numbers are the best case, not the worst.
Splitting the same results by where the attack hid makes the pattern clearer. Each number is the share of attacks that worked, so lower is better.
GPT-5, the newest model here, shows the pattern most clearly. Fake tool responses almost never fooled it, which matches OpenAI's own number. Instructions hidden in retrieved content worked 30% of the time in one study, and instructions hidden in tool descriptions worked about half the time. Older models like Sonnet 4 were fooled through every path.
That lines up with what the labs say they train for. Anthropic defines prompt injection as
instructions that arrive through tool results,
and OpenAI says it teaches its models
to ignore prompt injections in web or connector contents
(GPT-5 card, p. 10).
None of the system cards from either lab report testing tool descriptions. So tool responses are the safer
path, but attackers have other ways in, and nothing in the labs' reports shows even the newest models are
trained or tested against them.
Takeaways
- Tool responses are the safer path. The newest models rarely fall for injections there, in the labs' own tests and in some independent ones.
- Tool descriptions and retrieved content are not. GPT-5 was fooled about half the time through tool descriptions, and no lab reports testing that path.
- The model is only one layer. Fallback routing and permissions matter too.
The charts above use attacks written for a test. Two 2026 studies looked for injections people have actually planted, which lets us ask: would today's models have stopped them?
Indirect Prompt Injection in the Wild (CISPA, arXiv preprint) scanned 1.2 billion web addresses from an October 2025 Common Crawl snapshot, plus Shodan and Censys. Most injections sit where only machines look, such as headers, comments and metadata, and most reuse a small set of templates that tell the model to drop its task.
Google ran its own scan of Common Crawl and found the same thing. Injections are growing, but most are pranks and experiments, not the advanced attacks researchers have published. Google reads that as a sign that attackers haven't put that research to use yet.
The CISPA team took 100 of these real injections and tried them on 13 models. The small models were fooled the most. GPT-5.4, the newest model they tested, was almost never fooled.
That's the same GPT-5.4 that Gray Swan fooled about 1 time in 3 in April. The difference is the attacker:
Gray Swan's red-teamers tune their attacks and get 100 tries, while a web injection is a fixed template
with one shot. Anthropic says as much: simple attacks do not succeed anymore
(Opus 5.5 System Card, p. 123).
For now, the lab tests are the harder bar. Two caveats: some models
spotted an injection and followed it anyway,
and the authors expect attacks to become
more adaptive and targeted.
Most software doesn't read the open web, but anything a user can supply still reaches the model. Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening (USENIX Security 2026) checked about 200,000 real resumes from a hiring platform. About 1% hid an injection, and the number keeps rising. Most of them weren't instructions at all, and 9 in 10 were just hidden data, like invisible lists of skills meant to game keyword matching.
The paper didn't test whether these worked.
Takeaway
Real injections are out there and growing, but for now they're crude, and frontier models mostly ignore them. Your software doesn't need to browse the web to be exposed.
Yes. Two reports from September 2026, one from Anthropic and one from Google's threat intelligence team (GTIG), describe criminals using prompt injection against real companies. Every group they name was after money. Neither report shows government hackers doing it.
TeamPCP also used it against defenders. Its malware starts with fake "SYSTEM OVERRIDE" text asking for weapons instructions, likely so AI security scanners refuse to read on and miss the malicious code below.
Not much against the newest models, at least with today's attacks. That could change if someone finds a new kind of attack. It's still a real threat with many other labs' models (six were fooled 24–60% of the time), when a request falls back to a weaker model, and when the agent can reach keys and passwords.
Simple attacks mostly fail now. In Anthropic's words,
simple attacks do not succeed anymore
(p. 123).
But attackers who keep trying still get through. In Microsoft's LLMail-Inject challenge,
16.6% of teams
beat every defence stacked together. Nasr, Carlini and others broke
12 published defences, most over 90% of the time.
And in Gray Swan's competition, attackers kept breaking every model at a steady rate; the authors say even
the more robust models remain susceptible under sustained adversarial pressure
(p. 9).
All of this was on older models. On the newest ones, only the labs' own tests exist so far (Opus 5.5, GPT-6 Astra), and they rarely got through.
MCP is where the picture is least settled. The labs train and test their models on instructions hidden in tool results, and that's where the newest models hold up. But MCP gives attackers other ways in. Tool descriptions fooled GPT-5 about half the time, and neither lab's system cards test that path. So when you connect an MCP server, you're trusting what its tools say about themselves, not just what they return. The studies point to the same fixes. Limit what each tool can read and send (Parasites), check tool calls before they run (MCPTox), and enforce permissions (AgentBound), knowing they won't stop attacks that stay inside what's allowed.
Hope this helped
-- End