Opus 5 may curb browser hijacks

Browser automation agents like Claude Cowork read web pages, click through them, and fill in forms on a user's behalf. That capability is also the vulnerability: an agent reading a page can't cleanly distinguish the user's own instruction from any other text on that page. An attacker can hide a command like "change this setting" or "send this data elsewhere" in white-on-white text or a hidden element, and the agent may mistake it for a legitimate instruction and act on it. This is known as an indirect prompt injection attack.

In the Opus 4.8 system card (published May 28, 2026), Anthropic disclosed that the browser agent's hijack success rate was 31.5% with no safeguards applied. That means the agent followed a page's hidden instruction nearly one time in three — a remarkably concrete number for a frontier lab to publish about its own model's weaknesses. Using that figure as a baseline, Anthropic measured how much the newly released Claude Opus 5 (July 24, 2026) improved, using the same methodology.

Through 2026, browser automation agents like Claude Cowork have started seeing real production use for routine tasks such as expense processing, competitive research, and form filling. Prompt injection used to be discussed mostly as a theoretical risk, but the fact that Anthropic devotes a dedicated research post to defending against prompt injection in browser use reflects how urgently priorities have shifted now that agents routinely touch money, credentials, and internal data on the open web. A disclosure tied to a concrete figure like 31.5% is also becoming one of the few common yardsticks the industry can use to compare how different labs are handling this risk.

One distinction worth keeping in mind: the 0% figure only holds with Auto Mode, a product-level safeguard, turned on, while 3.70% reflects the model's own resistance with no safeguards applied. Both numbers improving suggests Anthropic isn't simply trusting a smarter model to handle everything — it's raising the bar on both the model itself and the layered, product-side defenses around it. A design that doesn't rely on a single line of defense is easier to trust against attack patterns nobody has seen yet.

The headline says "may curb," not "solved," for a reason. First, these figures come from Anthropic's own test environment; real attackers have financial incentive to keep probing for novel techniques, so a 0% score in-house doesn't guarantee the same result in production. Second, that 0% only holds with Auto Mode turned on — the model alone, with no safeguards, still gets hijacked 3.70% of the time, so custom-built agent stacks that don't use Auto Mode may not benefit from this protection. Third, figures like Gray Swan's 2.0% and the 0.39–0.54% attack success rates in non-browser computer-use settings show that "reduced" is a more accurate word than "eliminated" across several of these metrics.

A recurring lesson from security research is that publishing a defense can also draw attention from attackers. The 31.5% figure itself may have signaled that browser agents are a promising target, and more sophisticated indirect prompt injection techniques are a realistic possibility going forward. Companies deploying these agents should treat this improvement not as a reason to stop worrying, but as grounds for moving to the next stage of rollout with somewhat more confidence than before.