A smarter model still doesn't
retire the execution wall.
Headlines that read "prompt injection is basically solved" are exactly when to look closer. The fine print shows model-level defenses still have real gaps, and framework-level bugs sit there regardless of how smart the model gets.
Reading behind
the "0%" headline
According to THE DECODER, Anthropic's Opus 5, paired with "Auto Mode" — two stacked software defenses, one that scans incoming data for hidden instructions before the model processes them and one that blocks dangerous actions before execution — hit a 0% prompt-injection success rate across 129 browser-agent test scenarios. Read only the headline, and it sounds like the fight is over.
But the same report is explicit that the 0% figure holds only when those extra software layers are turned on. Without them, Opus 5 alone has a 3.7% success rate. In a separate test by security firm Gray Swan, the success rate after 15 attack attempts fell from 5.5% for Opus 4.8 to 2.0% for Opus 5 — better, but not zero. OpenAI itself publicly admitted in December 2025 that prompt injection "may never be fully solved." The model is genuinely improving, but reading "the model got smarter" as "the extra layers are optional" is premature.
Who this changes,
and how
Better model-layer benchmarks don't change what you need to do on the ground.
Engineers
Keep agent permissions minimal, and keep human-approval gates on risky actions — file writes, payments, shell execution. A safer model is not a reason to remove the extra layers. Track updates and patch status for whichever frameworks you actually run, including Semantic Kernel, CrewAI, LangChain, and MCP implementations.
PMs and Product Owners
Don't loosen security review cadence or approval flows just because a model benchmark improved. The 0% figure is conditional on Auto Mode being enabled — whether your own deployment meets that condition is a separate question. Keeping red-team testing cadence intact is still a PM-side call.
Same "Opus 5,"
different numbers by measure
Cite "0%" without the conditions attached and you misread the actual state of things.
A stronger model and an
unnecessary safeguard are two different claims.
The attack surface
extends past the model
However far prompt-injection defenses advance, a hole in the execution framework itself still matters.
The Microsoft Security Blog documents critical remote-code-execution (RCE) vulnerabilities in major AI agent frameworks — including Semantic Kernel, CrewAI, and LangChain — and in MCP implementations, where prompt injection could be chained into actual shell or code execution. These are execution-layer bugs, unrelated to how well the underlying model was trained on safety. A smarter model does not automatically fix a vulnerable framework.
Separately, a security audit published on Dev.to reportedly found 56-plus vulnerabilities across 13 AI agent frameworks, including 6 critical RCE-class flaws. The exact count isn't independently verified here, but it supports the same conclusion: even as model resilience improves, least-privilege execution still matters. Auto Mode's 0% is also conditional — it only applies when that condition is actually met, and many real deployments won't have it enabled.
What to do next
Keep least-privilege execution
Even as model benchmarks improve, keep agent execution permissions (files, payments, external APIs) minimal. Design as if the extra layers like Auto Mode may or may not be present.
Keep human approval on risky actions
Route irreversible actions, payments, and outbound data transfers through human approval. 0% is a figure under test conditions, not a guarantee for production.
Keep red-teaming and auditing frameworks
Continuously track updates and RCE-related fixes for whichever frameworks you actually run — Semantic Kernel, CrewAI, LangChain, MCP — and apply patches promptly.