--- title: Schneier on Security | daily.dev description: Anthropic's Claude Opus 5 shows significant improvement in resisting prompt injection attacks on the IPI benchmark, reducing attacker success probability... canonical: https://daily.dev/posts/schneier-on-security-qhorzgh9d twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Schneier on Security | daily.dev og:description: Anthropic's Claude Opus 5 shows significant improvement in resisting prompt injection attacks on the IPI benchmark, reducing attacker success probability... og:url: https://daily.dev/posts/schneier-on-security-qhorzgh9d og:image: https://api.daily.dev/og/posts/qhorZGH9d.png og:image:alt: Schneier on Security og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Schneier on Security **[Schneier on Security](https://daily.dev/sources/schneier)** · 1 min read · 1 upvotes · 1 comments ## Summary Anthropic's Claude Opus 5 shows significant improvement in resisting prompt injection attacks on the IPI benchmark, reducing attacker success probability within 15 attempts from 5.5% (Opus 4.8) to 2.0%. It outperforms all other evaluated models, including GPT 5.6 Sol, which is 10 times more likely to be successfully attacked. Bruce Schneier notes that while preventing prompt injection is theoretically impossible in the general case, practical robustness continues to improve. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How well does Claude Opus 5 resist prompt injection attacks compared to Opus 4.8? Claude Opus 5 reduces the probability of a successful prompt injection attack within 15 attempts from 5.5% (Opus 4.8) to 2.0%, and from 0.5% to 0.2% within a single attempt, according to Anthropic's IPI benchmark results published in the Opus 5 system card. It also outperforms Sonnet 5 (5.9% at 15 attempts) and Mythos 5 (2.6%), making it the most robust model evaluated on this benchmark. _Developers hardening AI agents against prompt injection can follow model security benchmarks on daily.dev._ ### How does GPT 5.6 compare to Claude Opus 5 on prompt injection resistance? GPT 5.6's most capable variant, Sol, is roughly 10 times more vulnerable to prompt injection than Claude Opus 5, with a 20.0% attack success rate within 15 attempts versus Opus 5's 2.0%. Other GPT 5.6 variants perform worse still, with Terra at 30.4% and Luna at 43.9%. A single attempt against GPT 5.6 Sol succeeds 3.1% of the time, higher than Opus 5's rate after fifteen attempts. _Teams choosing between GPT and Claude models for agentic tasks weigh security tradeoffs like these on daily.dev._ ### Is it possible to fully prevent prompt injection attacks against LLMs? Complete prevention of prompt injection is widely considered impossible in the general case, since current LLM architectures process instructions and untrusted input as a single undifferentiated token stream, making it hard to reliably distinguish trusted from untrusted tokens. Improvements like those in Claude Opus 5 reduce attack success rates in specific benchmarked cases, but do not eliminate the underlying vulnerability. Alternative model architectures might address this limitation in the future. _Anyone building LLM-integrated systems tracks prompt injection defenses and their limits on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 0 upvotes > What happens to that 2% when attackers adapt to the model and get more than 15 tries? ## Similar posts on daily.dev - [Breaking Opus 4.7 with ChatGPT \(Hacking Claude's Memory\) · Embrace The Red](https://daily.dev/posts/breaking-opus-4-7-with-chatgpt-hacking-claude-s-memory-embrace-the-red-i3pdz3zfb) · Embrace The Red · 1 upvotes · 0 comments - [Sol in the shade: benchmarking Opus 4.6 and GPT-5.6 Sol for finding zero-days](https://daily.dev/posts/sol-in-the-shade-benchmarking-opus-4-6-and-gpt-5-6-sol-for-finding-zero-days-tqpwwjimp) · Medium · 0 upvotes · 0 comments - [Claude Sonnet 5: A Security Deep Dive for AI Agent Deployments](https://daily.dev/posts/claude-sonnet-5-a-security-deep-dive-for-ai-agent-deployments-niacrikpi) · Medium · 1 upvotes · 0 comments --- Tags: [#llm](https://daily.dev/tags/llm), [#claude](https://daily.dev/tags/claude), [#anthropic](https://daily.dev/tags/anthropic), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection) [View this post on daily.dev](https://daily.dev/posts/schneier-on-security-qhorzgh9d) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Schneier on Security","url":"https://daily.dev/posts/schneier-on-security-qhorzgh9d","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-qhorzgh9d"},"datePublished":"2026-07-31T17:25:45.757Z","dateModified":"2026-09-13T18:30:01.898Z","description":"Anthropic's Claude Opus 5 shows significant improvement in resisting prompt injection attacks on the IPI benchmark, reducing attacker success probability...","image":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","thumbnailUrl":"https://media.daily.dev/image/upload/s--OHB84bZF--/f_auto/v1722860399/public/Placeholder%2010","isAccessibleForFree":true,"articleSection":"Schneier on Security","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Schneier on Security","logo":"https://media.daily.dev/image/upload/s--0aZDA7eZ--/f_auto/v1758461069/logos/schneier","url":"https://daily.dev/sources/schneier"},"commentCount":1,"discussionUrl":"https://daily.dev/posts/schneier-on-security-qhorzgh9d","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":1},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":1}],"keywords":"llm,claude,anthropic,ai-security,prompt-injection","timeRequired":"PT1M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Schneier on Security","item":"https://daily.dev/sources/schneier"},{"@type":"ListItem","position":3,"name":"Schneier on Security"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/schneier-on-security-qhorzgh9d","comment":[{"@type":"Comment","text":"What happens to that 2% when attackers adapt to the model and get more than 15 tries?","datePublished":"2026-08-02T20:03:03.545Z","url":"https://daily.dev/posts/qhorZGH9d#c-BL4eWuBsI","author":{"@type":"Person","name":"Agustin Barrientos","url":"https://daily.dev/agustinbarrientos","image":"https://media.daily.dev/image/upload/s--5ayxQnqn--/f_auto/v1788281802/avatars/avatar_wQYYVe5Tbj0NJ7C7qPoa8?_a=BAMAMicg0"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/schneier-on-security-qhorzgh9d#faq","mainEntity":[{"@type":"Question","name":"How well does Claude Opus 5 resist prompt injection attacks compared to Opus 4.8?","acceptedAnswer":{"@type":"Answer","text":"Claude Opus 5 reduces the probability of a successful prompt injection attack within 15 attempts from 5.5% (Opus 4.8) to 2.0%, and from 0.5% to 0.2% within a single attempt, according to Anthropic's IPI benchmark results published in the Opus 5 system card. It also outperforms Sonnet 5 (5.9% at 15 attempts) and Mythos 5 (2.6%), making it the most robust model evaluated on this benchmark. Developers hardening AI agents against prompt injection can follow model security benchmarks on daily.dev."}},{"@type":"Question","name":"How does GPT 5.6 compare to Claude Opus 5 on prompt injection resistance?","acceptedAnswer":{"@type":"Answer","text":"GPT 5.6's most capable variant, Sol, is roughly 10 times more vulnerable to prompt injection than Claude Opus 5, with a 20.0% attack success rate within 15 attempts versus Opus 5's 2.0%. Other GPT 5.6 variants perform worse still, with Terra at 30.4% and Luna at 43.9%. A single attempt against GPT 5.6 Sol succeeds 3.1% of the time, higher than Opus 5's rate after fifteen attempts. Teams choosing between GPT and Claude models for agentic tasks weigh security tradeoffs like these on daily.dev."}},{"@type":"Question","name":"Is it possible to fully prevent prompt injection attacks against LLMs?","acceptedAnswer":{"@type":"Answer","text":"Complete prevention of prompt injection is widely considered impossible in the general case, since current LLM architectures process instructions and untrusted input as a single undifferentiated token stream, making it hard to reliably distinguish trusted from untrusted tokens. Improvements like those in Claude Opus 5 reduce attack success rates in specific benchmarked cases, but do not eliminate the underlying vulnerability. Alternative model architectures might address this limitation in the future. Anyone building LLM-integrated systems tracks prompt injection defenses and their limits on daily.dev."}}]} ```