Claude Opus 4.5 improves against prompt injection attacks

Anthropic says Claude Opus 4.5 significantly reduces the risk of prompt injection, an attack that inserts malicious instructions into websites, emails, or documents to redirect an AI's behavior. The problem is not solved, but the company says the new model reaches an attack success rate of 1% in one of its internal tests.

How a browser agent can be tricked

An AI agent does more than answer questions. It can also open websites, read emails, fill out forms, click buttons, or download files. To do that, it has to process content it does not control, and that is where the risk appears.

Imagine asking it to review your emails and draft replies to meeting invitations. One of those messages looks like a normal inquiry from a vendor, but contains hidden instructions in white text. The agent could interpret them as commands and forward messages containing the word “confidential” to an external address.

You might not see the attack. The AI could still process it.

The browser expands the problem because every external element can become an entry point:

• Websites and embedded documents.
• Ads and dynamically loaded elements.
• Buttons, forms, and manipulated interfaces.
• Images with hidden or deceptive instructions.

If the agent falls for the trap, the attacker can do more than influence what it says. They can also try to make it take actions with real-world consequences.

What has changed in Claude

Anthropic compares the current version of its browser extension with the original configuration of Claude for Chrome, launched as a research preview. For the evaluation, it used an internal adaptive attacker called “Best-of-N,” which combines different known prompt injection techniques to find a way past the defenses.

The company attributes the improvement to three lines of work:

• Targeted training: during reinforcement learning, Claude receives simulated web content containing malicious instructions and is rewarded when it identifies and rejects them.
• More precise classifiers: systems that review untrusted content before it reaches the model's context and detect hidden commands, manipulated images, or deceptive interface elements.
• Continuous security testing: human teams look for new ways to attack the agent, both inside Anthropic and through external challenges.

These defenses do not depend solely on Claude Opus 4.5. Anthropic also says it has improved the controls that accompany all of its models in the extension.

What it means for you

The improvement allows Claude for Chrome to move from a research preview to a beta available to all users on the Max plan. In practice, this means you can delegate more browsing tasks with less risk than before, but not with zero risk.

An attack success rate of 1% still matters if the agent has access to emails, accounts, private documents, or work systems. That is why you should review its actions, limit permissions, and avoid letting it operate unsupervised on sensitive tasks.

The important point is that a browser agent does not treat the entire web as neutral information. Every page can contain instructions aimed at the AI, even if it appears designed for a person. Anthropic will continue measuring and publishing progress because as long as these systems can take action, security will depend on both the model and the controls around it.