Is indirect prompt injection still a big threat as models get more advanced?

Inside the labs: are newer models harder to fool?

Labs often publish a system card alongside major releases: a report on how the model was built and tested. The idea grew out of model cards, proposed by Mitchell et al. in 2018. Each lab keeps its cards in one place: Anthropic, OpenAI and Google DeepMind.

Part of that testing comes from Gray Swan, an outside red-team company. Gray Swan runs public competitions in its Arena, where thousands of people try to trick AI models. It keeps the attacks that fool many different models, not just the one they were aimed at, and packs them into a benchmark that labs run before release. The April chart uses its ART benchmark, which covers tool use only. By mid-year, Claude models had largely maxed it out, so the September chart uses its newer, broader IPI benchmark, which adds coding and computer use.

April 2026: attackers get 100 tries

Model	Attack success	About 1 time in…
Gemini 3.1 Pro	45.5%	1 in 2
GPT-5.4	32.5%	1 in 3
Claude Opus 4.6	21.7%	1 in 5
Claude Opus 4.7	6.0%	1 in 17

In April, an attacker allowed 100 tries per scenario could still trick a lot of models. Against GPT-5.4, the attacker succeeded about 1 time in 3, and against Gemini 3.1 Pro almost 1 time in 2. Claude's newest model held up much better: against Opus 4.7, the attacker succeeded 6.0% of the time, down from 21.7% for Opus 4.6.

September 2026: a new test, 15 tries

Model	Attack success	About 1 time in…
GPT-5.6 Sol	27.0%	1 in 4
GPT-6 Astra	8.5%	1 in 12
Claude Opus 5	4.8%	1 in 21
Claude Opus 5.5	1.0%	1 in 100

By September, even with 15 tries, the estimated chance of a successful attack on Opus 5.5 was 1.0%, down from 4.8% for Opus 5. OpenAI improved too: GPT-6 Astra's was 8.5%, down from 27.0% for GPT-5.6 Sol.

What about models from other labs?

It varies a lot. In the same September test, the best of them came close to Claude: Gemini 3.8 Flash at 5.5% (Opus 5.5 card, p. 85), GPT-6 Astra at 8.5% and Gemini 3.7 Flash at 9.2%, against 4.8% for Claude Opus 5. But six others scored 24% to 60% (GPT-6 Astra system card).

And the gap only runs one way. In Gray Swan's 2025 competition, the attacks that managed to break Claude Opus 4.5 went on to work against the other models 44–81% of the time, while attacks that broke the weaker models rarely got past the stronger ones.

So the labs' own numbers point one way: prompt injection is getting harder to pull off, and fast, especially against the newest models from Anthropic and OpenAI.

Does another benchmark agree?

Gray Swan, which also ran with thinking off, found the bigger model slightly ahead: Opus 4.5 at 0.5%, Sonnet 4.5 at 1.0% and Haiku 4.5 at 1.3% (p. 9). But all three sit within about a point, and the authors conclude that robustness depends more on model family and its training recipe than the raw capability of models (p. 10).

Reasoning: no fair comparison yet

Lakera found that adding reasoning generally improves the security, and that only the tiny model versions exhibit decreased security as reasoning increases (p. 8).

Gray Swan's April chart was mixed: turning thinking on helped four models and hurt four others, including Opus 4.6 and Opus 4.7 (p. 83). But it tested different models from Lakera's, so the two can't be set side by side. By September, Gray Swan ran every model with thinking on, so its results compare models on the same footing.

Should Claude be your go-to model for agents?

Yes, on this evidence. Claude leads in the labs' charts and in Lakera's test. But Anthropic's own report flags two things to check before you rely on it:

• Check which model actually answers. When a cyber-safety check triggers, Opus 5.5 hands the request to the older Opus 4.8. In Anthropic's adaptive coding test, that happened for about two thirds of requests, and attacks got through on most of those. None got through on the requests Opus 5.5 answered itself.
• Check how outside text reaches the model. Claude is trained to distrust instructions that arrive in tool results. Text pasted into the user's own message is a weaker spot: an early Opus 5.5 build followed planted instructions there about half the time. Retraining cut that to about 2%, and Anthropic's own apps add fixes that bring it to zero. If you build on the API, you may need similar fixes of your own.

So Claude is a strong default for agents, as long as you check which model actually answers and how outside text reaches it.

MCP: more ways in than the labs test

The lab charts only test instructions hidden in the content an agent reads, like web pages, files and tool results. MCP gives attackers more ways in. They can hide instructions in a tool's description, pass them through tool arguments, or ship a server with malicious code. The studies below test these paths, but on older models like GPT-5 and Sonnet 4.5. So they don't show the lab numbers are wrong, just what the labs leave untested.

Same models, three sets of results

Older system cards from Anthropic and OpenAI tested some of the same models these studies used. They report two kinds of results, the labs' own fixed tests and Gray Swan's red-team benchmark, so we can put all three side by side.

Dates are when each result was published. For the MSB and Parasites papers, that's the version the numbers come from. * Across MSB's injections in tool descriptions, tool responses and retrieved content, leaving out a test that only asks for the model's name. Gray Swan later re-graded its benchmark, so newer cards show lower numbers for the same models. These are the earliest published figures.

The labs publish both kinds of numbers, often in the same report. Their own fixed tests stopped most injections. Gray Swan's red-teamers, given 10 tries, got through more than half the time on every one of these models.

The independent MCP studies land in between, and where the attack hides decides the result. GPT-5 held up against fake tool responses, just as OpenAI reported, but tool descriptions fooled it about half the time.

The labs' own tougher tests agree. Once attackers could adapt, Sonnet 4.5 and GPT-5.4 were fooled far more often. GPT-5.4 blocked 99.8% of OpenAI's fixed connector attacks (GPT-5.6 card) but only 93.954% from its automated red-teamer, GPT-Red (GPT-6 Astra card, Figure 4, printed p. 18). As Anthropic puts it, fixed tests can provide a false sense of security (Opus 4.5 card, p. 60). The headline lab numbers are the best case, not the worst.

Safer in tool responses, not in tool descriptions

Splitting the same results by where the attack hid makes the pattern clearer. Each number is the share of attacks that worked, so lower is better.

GPT-5, the newest model here, shows the pattern most clearly. Fake tool responses almost never fooled it, which matches OpenAI's own number. Instructions hidden in retrieved content worked 30% of the time in one study, and instructions hidden in tool descriptions worked about half the time. Older models like Sonnet 4 were fooled through every path.

That lines up with what the labs say they train for. Anthropic defines prompt injection as instructions that arrive through tool results, and OpenAI says it teaches its models to ignore prompt injections in web or connector contents (GPT-5 card, p. 10). None of the system cards from either lab report testing tool descriptions. So tool responses are the safer path, but attackers have other ways in, and nothing in the labs' reports shows even the newest models are trained or tested against them.

Outside the labs: how real is the threat?

The charts above use attacks written for a test. Two 2026 studies looked for injections people have actually planted, which lets us ask: would today's models have stopped them?

On the open web

Would today's models have stopped them? Mostly

The CISPA team took 100 of these real injections and tried them on 13 models. The small models were fooled the most. GPT-5.4, the newest model they tested, was almost never fooled.

That's the same GPT-5.4 that Gray Swan fooled about 1 time in 3 in April. The difference is the attacker: Gray Swan's red-teamers tune their attacks and get 100 tries, while a web injection is a fixed template with one shot. Anthropic says as much: simple attacks do not succeed anymore (Opus 5.5 System Card, p. 123). For now, the lab tests are the harder bar. Two caveats: some models spotted an injection and followed it anyway, and the authors expect attacks to become more adaptive and targeted.

What about targeted attacks that never touch the web?

Most software doesn't read the open web, but anything a user can supply still reaches the model. Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening (USENIX Security 2026) checked about 200,000 real resumes from a hiring platform. About 1% hid an injection, and the number keeps rising. Most of them weren't instructions at all, and 9 in 10 were just hidden data, like invisible lists of skills meant to game keyword matching.

The paper didn't test whether these worked.

So, have real attackers used it yet?

Conclusion: is indirect prompt injection still a threat?

Not much against the newest models, at least with today's attacks. That could change if someone finds a new kind of attack. It's still a real threat with many other labs' models (six were fooled 24–60% of the time), when a request falls back to a weaker model, and when the agent can reach keys and passwords.

Simple attacks mostly fail now. In Anthropic's words, simple attacks do not succeed anymore (p. 123). But attackers who keep trying still get through. In Microsoft's LLMail-Inject challenge, 16.6% of teams beat every defence stacked together. Nasr, Carlini and others broke 12 published defences, most over 90% of the time. And in Gray Swan's competition, attackers kept breaking every model at a steady rate; the authors say even the more robust models remain susceptible under sustained adversarial pressure (p. 9).

All of this was on older models. On the newest ones, only the labs' own tests exist so far (Opus 5.5, GPT-6 Astra), and they rarely got through.

MCP is where the picture is least settled. The labs train and test their models on instructions hidden in tool results, and that's where the newest models hold up. But MCP gives attackers other ways in. Tool descriptions fooled GPT-5 about half the time, and neither lab's system cards test that path. So when you connect an MCP server, you're trusting what its tools say about themselves, not just what they return. The studies point to the same fixes. Limit what each tool can read and send (Parasites), check tool calls before they run (MCPTox), and enforce permissions (AgentBound), knowing they won't stop attacks that stay inside what's allowed.