Anthropic 称 Opus 5 几乎免疫浏览器提示词注入，攻击成功率降至零

Anthropic 表示 Opus 5 在其自有软件中几乎对提示注入免疫。提示注入：https://the-decoder.com/claude-cowork-hit-with-file-stealing-prompt-injection-days-after-anthropics-launch/，指攻击者通过网页上的隐藏文本等操纵输入，绕过 AI 模型的指令，这在几乎所有情况下对 Opus 5 都失败了。对于浏览器代理，根据系统手册：https://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf#page=76，129 个测试场景下攻击成功率为零。这很重要，因为 OpenAI 在去年 12 月承认提示注入可能永远无法完全解决：https://the-decoder.com/openai-admits-prompt-injection-may-never-be-fully-solved-casting-doubt-on-the-agentic-ai-vision/。在安全公司 Gray Swan：https://www.grayswan.ai/ 进行的一般提示注入测试中，经过 15 次尝试后的成功率从 5.5%（Opus 4.8）下降到 2.0%。

这个零成功率仅在 Claude Cowork 等产品开启自动模式时有效：https://www.anthropic.com/engineering/claude-code-auto-mode。自动模式叠加了两层防御。第一层在模型处理数据之前扫描输入数据中隐藏的指令。第二层在执行前阻止危险操作。攻击者必须分别击败这两层。没有这两层，Opus 5 的成功率为 3.7%，而 Sonnet 5 实际上表现更好，为 0.93%。只有模型与保护软件结合，才可将成功率降至零。

保持对 AI 的关注。清晰、有用、无废话。

关注 The Decoder 获取 AI 新闻、背景故事和专家分析。

The Decoder：https://the-decoder.com/

Anthropic says Opus 5 is nearly immune to prompt injections in its own software. Prompt injection：https://the-decoder.com/claude-cowork-hit-with-file-stealing-prompt-injection-days-after-anthropics-launch/, where an attacker slips past an AI model's instructions through manipulated inputs like hidden text on a webpage, fails against Opus 5 in almost every case. For browser agents, the attack success rate hit zero percent across 129 test scenarios, per the system card：https://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf#page=76. That's a big deal given that OpenAI admitted in December that prompt injection may never be fully solved：https://the-decoder.com/openai-admits-prompt-injection-may-never-be-fully-solved-casting-doubt-on-the-agentic-ai-vision/. In a general prompt injection test by security firm Gray Swan：https://www.grayswan.ai/, the success rate after 15 attempts dropped from 5.5 percent (Opus 4.8) to 2.0 percent.

That zero percent rate only holds with Auto Mode turned on in products like Claude Cowork：https://www.anthropic.com/engineering/claude-code-auto-mode. Auto Mode stacks two defense layers. One scans incoming data for hidden instructions before the model processes them. The other blocks dangerous actions before execution. An attacker has to beat both independently. Without them, Opus 5 sits at 3.7 percent, and Sonnet 5 actually does better at 0.93 percent. Only the combination of model and protective software pushes the rate to zero.

Stay in the loop on AI. Clear, useful, no fluff.

Follow The Decoder for AI news, background stories and expert analyses.

The Decoder：https://the-decoder.com/