Anthropic says Opus 5 is its hardest model yet to prompt-inject — the evidence sits in the system card

On 25 July 2026 Boris Cherny of Anthropic said Claude Opus 5 is "our least prompt injectable model yet," pointing at the injection evaluations and red-teaming recorded in the model’s system card (page 73). Simon Willison relayed the claim without independent analysis, and no third-party injection benchmark has been published against the model yet.

What it means Prompt injection is still the open hole in every tool-using agent. A vendor claim of improvement is worth tracking, but until it is independently measured your permission gates stay exactly as load-bearing as they were.