Opus 5 reduces the prompt injection rate to 2% at k=15 - Schneier validates the trajectory

On the IPI benchmark, Opus 5 reduces the attacker success rate of Opus 4.8 by nearly threefold. The best non-Claude model evaluated remains at 16.5%. Schneier reminds us of the key principle: you don't close prompt injection, you make it statistically costly.

The Fact

On Anthropic's IPI (Indirect Prompt Injection) benchmark, Opus 5 claims a 2.0% attack success rate in 15 attempts (compared to 5.5% for Opus 4.8), and 0.2% in a single attempt (compared to 0.5%). Lab comparison within the same family: Sonnet 5 at 5.9% (k=15), Mythos 5 at 2.6%. The best non-Claude model evaluated on this benchmark, Muse Spark, caps at 16.5%—more than eight times Opus 5's rate. Bruce Schneier cites these figures on his blog on July 31, 2026, reiterating his stance: preventing prompt injection remains impossible in the general case, but the field is making clear progress on specific cases.

Our Analysis

Two points matter beyond the vendor's figure. First: the non-Claude baseline, 16.5%, shows the gap on this vector is real, not negligible—for an enterprise deployment exposing an agent to third-party content (emails, docs, web), reducing the rate from 16% to 2% changes the operational cost of the exploit. Second: Schneier's take—“progress on specific cases, not resolution”—is the right posture. We’re not closing prompt injection, we’re making it statistically expensive.

To Watch

The full IPI protocol (dataset, adversaries, categories) and reproducible third-party evaluations. Without them, the 2% figure lives in product marketing, not in the SOC.