Anthropic’s newly evaluated Claude Opus 5 model significantly outperforms competitors in resisting prompt injection attacks, reducing successful breaches to 2.0% within 15 attempts on the Inject-Prompt Invalidation (IPI) benchmark.
We already know that absolute prevention of prompt injection remains an intractable computer science problem in the general case. Yet, the architectural hardening of frontier LLMs is yielding practical gains.
Benchmarking the Vulnerability Gap Across Frontier Models
On the IPI benchmark, Opus 5 improved over its predecessor, Opus 4.8, reducing the probability of an attacker succeeding within 15 attempts from 5.5% down to 2.0%. Single-attempt success rates for Opus 5 dropped from 0.5% to a negligible 0.2%.
Other models in Anthropic’s lineup also posted formidable defense metrics. Sonnet 5 recorded a 5.9% success rate at $k=15$ attempts, while Mythos 5 logged 2.6%.
The most robust non-Claude model evaluated was Muse Spark, which hit a 16.5% success rate within 15 attempts—more than eight times the failure rate of Opus 5. Meanwhile, OpenAI’s flagship lineup struggled under the same testing parameters.
How OpenAI’s GPT-5.6 Variants Fare Against Adversarial Inputs
OpenAI’s latest iteration fails to close the security gap. The most capable GPT-5.6 variant, Sol, performed comparably to its predecessor, GPT 5.5. Sol recorded a 20.0% success rate for attackers within 15 attempts, virtually unchanged from the 20.8% logged by the older GPT 5.5 model.
This means Sol is roughly 10 times as likely to be successfully compromised via prompt injection as Claude Opus 5. Other variants within the GPT-5.6 family proved even more susceptible to adversarial manipulation. Terra recorded a 30.4% success rate, while Luna slumped to 43.9% over the same 15-attempt threshold.
Even a single-shot attack against GPT-5.6 Sol succeeded 3.1% of the time. That single-attempt metric is higher than the cumulative 2.0% risk an attacker achieved against Opus 5 after fifteen full attempts.
