Opus 5's Auto Mode drops browser prompt-injection to 0% in tests
The 0% needs Anthropic's two-layer defense, not the model alone (3.7%) — and researchers say Claude for Chrome's extension still has an unpatched bypass.
Copy markdown
0 of 129, but the scaffolding earns it
In Anthropic's Opus 5 browser evaluation — 129 held-out environments, 10 attacks each — Auto Mode's two layers (a classifier that scans page content for hidden instructions, plus an action-blocker that vetoes dangerous steps) stopped every attack: a 0% success rate. That combined defense is the guarantee to design around, not the raw model.
Strip the guardrails and it's 3.7% — behind Sonnet 5
Turn Auto Mode off and Opus 5's own resistance falls to a 3.7% attack-success rate — actually worse than Sonnet 5's 0.93%. The takeaway for builders: don't assume the bare API model is injection-proof. The safety lives in the wrapper, so ship the wrapper.
The hole it doesn't close: user-pasted prompts
In red-teaming, when the user themselves pasted malicious text into the agent, attackers succeeded 24 of 25 times. If your workflow pipes user-supplied or pasted content straight into an agent that can act, the classifier won't cover you.
Meanwhile, Claude for Chrome is still bypassable
Separate research (Manifold's "ClaudeBleed") reports the shipping extension, v1.0.80, still trusts synthetic clicks — it never checks event.isTrusted — so any installed extension can fire allowlisted Gmail, Docs and Calendar reads. Rated up to CVSS 9.6 with "Act without asking" enabled, and reportedly still unpatched. It's a different attack surface than model-level injection, so the 0% figure doesn't touch it.
What to do if you ship browser agents
Keep Auto Mode on for any untrusted page, leave "Act without asking" off by default, treat every installed browser extension as a possible trigger, and never route user-pasted text directly into an agent that can act. The 0% is real — but only inside those rails.