TL;DR: Claude Opus 5, released July 24, 2026, leads on ARC-AGI-3 (30.2%), Frontier-Bench (43.3%), and GDPval-AA v2 (1,861 Elo) while costing half of Fable 5 at $5/$25 per million tokens. The headline is security: with Auto Mode, browser prompt injection hit 0% across 129 scenarios. Without it, Opus 5 alone sits at 3.7% — Sonnet 5 does better at 0.93%. Only the model-plus-software combination pushes to zero. This arrives in a month when four independent teams shipped working agent exploits, making Anthropic’s layered defense the summer’s most consequential security counterpoint.
Why Opus 5 Matters
Opus 5 landed 24 days after Sonnet 5 and six weeks after Fable 5 opened Anthropic’s fifth generation. It is not the biggest or most expensive Claude — Fable 5 edges it on SWE-bench Pro and legal benchmarks, Mythos 5 leads on cybersecurity. Opus 5’s bet is different: the mid-2026 market wants capability-per-dollar, not absolute capability.
It retains Opus 4.8’s $5/$25 per million token pricing while matching or exceeding Fable 5 on key benchmarks at half the input cost. Specs: 1M-token context window, extended thinking by default, per-request effort toggle (low/medium/high), safety classifiers triggering ~85% less often. Available on Claude Max (default), Claude Pro, Google Cloud Agent Platform, and Claude Code with Auto Mode.
(Source : AI Release Tracker — Claude Opus 5)
The real differentiator isn’t on a benchmark chart. It’s what happens when an agent encounters a webpage laced with hidden instructions. On that problem — widely considered AI agents’ hardest unsolved security challenge — Opus 5 with Auto Mode posted 0% success across 1,290 attack attempts.
Benchmarks: Frontier-Adjacent at Workhorse Pricing
| Benchmark | What It Measures | Opus 5 | Best Comparison |
|---|---|---|---|
| Frontier-Bench v0.1 | Agentic coding (% tasks) | 43.3% | GPT-5.6 Sol 34.4% · Fable 5 33.7% |
| ARC-AGI-3 | Novel reasoning (no memorization) | 30.2% | GPT-5.6 Sol 7.8% |
| GDPval-AA v2 | Knowledge work (Elo) | 1,861 | Fable 5 1,747 · GPT-5.6 Sol 1,736 |
| SWE-bench Pro | Real GitHub issue resolution | 79.2% | Mythos 5 80.3% · Fable 5 80.0% |
| CursorBench 3.2 | In-editor coding (max effort) | 70.0% | Fable 5 70.5% |
| FrontierCode v1.1 | Hard agentic coding | 53.4% | #1 tracked |
| Humanity’s Last Exam | Expert reasoning (tools) | 64.7% | #1 tracked |
| OSWorld 2.0 | Computer use (screen + apps) | 70.6% | #1 tracked |
| AutomationBench | Business workflows | 26% | #1 tracked |
(Source : Codersera — Claude Opus 5 Benchmarks Explained (2026))
Two patterns. Opus 5 wins outright on the hardest reasoning and agentic-coding evaluations. Frontier-Bench is the sharpest signal: 43.3% versus Fable 5’s 33.7%, more than double Opus 4.8’s 21.1%, at lower cost per task — the largest generational jump on agentic coding in the family’s history.
Where Opus 5 doesn’t lead, the gap is small enough that price becomes the deciding factor. On SWE-bench Pro, the deficit versus Mythos 5 is barely one point. On CursorBench 3.2, it’s within 0.5 points of Fable 5. For teams running AI in CI or the editor, half-price-for-near-parity is arbitrage.
ARC-AGI-3 deserves emphasis: 30.2% versus GPT-5.6 Sol’s 7.8% — roughly 3× the nearest competitor on the closest public proxy for reasoning that generalizes rather than pattern-matches. If the defining trait of a good agent is handling genuinely unfamiliar situations, this is the number that matters most.
Auto Mode: The Architecture Behind 0%
Prompt injection — an attacker hiding instructions inside content an agent reads — has been called fundamentally unsolvable at the model level. OpenAI said so in December 2025. In July 2026, four independent teams shipped working agent exploits, moving the threat from theory to demonstrated attack surface.
(Source : The Decoder — OpenAI admits prompt injection may never be fully solved)
Against that backdrop, Anthropic’s system card reports 0% browser prompt injection success across 129 scenarios with Auto Mode enabled. 1,290 attack attempts, zero successes.
(Source : The Decoder — Opus 5 may have solved browser-based prompt injection)
The Two-Layer Defense
The 0% is not a model property — it’s a system property. Auto Mode stacks two independent inspection layers:
Layer 1 — Input-Side Probe: Before external content enters the model’s context, a scanner examines web pages, files, and tool outputs for hidden instructions. Flagged content gets a warning prepended to the agent’s context.
Layer 2 — Output-Side Transcript Classifier: After the model generates a tool call, a separate classifier (Sonnet 4.6) inspects it before execution. Critically, it sees only the user’s message and the tool call — not the model’s utterances or tool outputs. It is “reasoning-blind by design”: an attacker who compromised the model’s internal chain of thought cannot influence the output-side judgment.
(Source : Anthropic Engineering — How we built Claude Code auto mode)
For an injection to succeed, the attacker must evade the input scanner, then steer the model into a tool call the output classifier independently judges safe. Getting past both layers, with the second blind to whatever payload compromised the first, is significantly harder than defeating either alone.
Without Auto Mode: The Model Isn’t the Hero
The system card’s bare-model results add critical context:
| Model (with thinking) | No defenses | Breached | With Auto Mode |
|---|---|---|---|
| Claude Opus 5 | 3.70% | 11/129 | 0% |
| Claude Sonnet 5 | 0.93% | 9/129 | 0% |
| Claude Opus 4.8 | 31.5% | 81/129 | 0.08% |
| Claude Mythos 5 | 29.7% | 71/129 | 0% |
(Source : XenoSpectrum — Has Claude Opus 5 Solved Prompt Injection?)
Key takeaways: Opus 5 improved ~10× over Opus 4.8 bare-model (31.5% → 3.7%). But Sonnet 5, a smaller model, actually outperforms Opus 5 without defenses (0.93% vs 3.70%) — raw capability and injection resistance don’t correlate within the family. Once Auto Mode activates, Opus 5, Sonnet 5, and Mythos 5 all reach 0%. The architecture, not any single model, does the heavy lifting.
Anthropic is not claiming it “solved” prompt injection. It is demonstrating that a systems approach — model improvements plus runtime safeguards — can make browser-based attacks practically infeasible.
Gray Swan IPI: Independent Validation
Anthropic commissioned Gray Swan to evaluate Opus 5 on an indirect prompt injection benchmark using 28 scenarios and 1,130 deduplicated attacks drawn from a public competition (464 participants, 272,000 attacks against 13 models). No additional defenses were applied:
| Model | 1 attempt | 10 attempts | 15 attempts |
|---|---|---|---|
| Claude Opus 5 | 0.2% | 1.6% | 2.0% |
| Claude Mythos 5 | 0.3% | 2.1% | 2.6% |
| Claude Opus 4.8 | 0.5% | 4.1% | 5.5% |
| Claude Sonnet 5 | 0.6% | 4.7% | 5.9% |
Opus 5 cut within-15-attempts success from 5.5% to 2.0% — a 60%+ reduction. At 0.2% single-attempt, an attacker needs ~500 independent tries for even a coin-flip chance of one success. These aren’t zeros, but they represent a meaningful generational improvement and place Opus 5 atop the benchmark. Notably, Gray Swan ran without Auto Mode — these numbers measure intrinsic model resilience, not the full product.
Honest Limits
Anthropic’s system card also reports adaptive evaluations where attackers refine inputs while observing model responses:
| Environment | Opus 5 alone | Opus 5 + probe |
|---|---|---|
| Coding (40 scenarios) | 0.56% | 0.18% |
| GUI operation (14 scenarios) | 0.54% | 0.25% |
The probe helps but doesn’t reach zero. Breaches occurred in 4/40 coding scenarios and 1/14 GUI scenarios even with defenses active. The browser 0% does not extend to code repos, MCP servers, or local files.
There’s a hard social engineering boundary. In a February 2026 internal exercise where the user pasted attacker-prepared instructions, AWS credential exfiltration succeeded 24/25 times. The system couldn’t distinguish the attack from a legitimate request — the user did ask for it. Prompt injection defenses cannot protect users from instructions they voluntarily provide.
(Source : WalletInvestor — Anthropic’s Claude Opus 5 reports zero prompt injection rate)
Anthropic’s help docs are explicit: “risk is not zero,” recommending trusted-site-only browsing and manual approval for high-risk actions.
Pricing: The Capability-per-Dollar Calculus
| Model / Mode | Input ($/M) | Output ($/M) |
|---|---|---|
| Opus 5 (standard) | $5 | $25 |
| Opus 5 (fast mode) | $10 | $50 |
| Claude Fable 5 | $10 | — |
On CursorBench 3.2, Opus 5 sits within 0.5 points of Fable 5 at half the input cost. On OSWorld 2.0, it beats Fable 5 at ~1/3 the budget. On AutomationBench, ~1.5× throughput of the next-closest model at matching cost. The pattern: lead or sit within a point of the leader while costing meaningfully less.
The effort toggle lets teams dial reasoning compute per request — low for routine tasks, high for hard problems — rather than switching between models. For Opus 4.8 users: same price, better capabilities, dramatically better security. For Fable 5 evaluators: does the remaining ~1% gap justify doubling input cost? Anthropic’s bet is that for most workflows, it doesn’t.
Implications for Agent Builders
Security teams get a validated design principle: prompt injection defense lives at the product layer, not the model layer. The defensible pattern is strong model + content inspection + action gating — not hoping the next release solves security.
AI procurement shifts: vendors must now explain how they inspect webpages, isolate prompts, and constrain tools — not just which LLM they use. “We run GPT-5.6” is no longer a security posture.
Competitive landscape: Anthropic has opened a third front beyond benchmarks and pricing: quantitatively demonstrable security. If independent testing validates the 0% browser result, the moat isn’t about intelligence — it’s about trustworthiness in adversarial environments. The market is moving from “can it complete the task?” to “can it do so safely on messy, adversarial inputs?”
(Source : The Decoder — OpenAI admits prompt injection may never be fully solved)
Caveat: the 0% is vendor-reported, not independently certified. Teams should run their own red-team exercises against their deployment environment.
FAQ
Is Opus 5 better than Fable 5?
It depends. Opus 5 leads Frontier-Bench (43.3% vs 33.7%), ARC-AGI-3 (30.2% vs unreported), and GDPval-AA v2 (1,861 vs 1,747). Fable 5 edges SWE-bench Pro (80.0% vs 79.2%) and remains recommended for multi-day autonomous agents. Opus 5’s advantage: near-frontier at half the input price.
Did Anthropic solve prompt injection?
No. The 0% applies to browser injection with Auto Mode in controlled tests. Coding/GUI evaluations show non-zero breach rates (0.18–0.25%). Anthropic states “risk is not zero.” They demonstrated that layered architecture can reduce browser attacks to practical infeasibility — significant but bounded.
What does Opus 5 cost?
$5/M input, $25/M output — same as Opus 4.8. Fast mode: $10/$50 for ~2.5× speed. Half Fable 5’s input price.
How does it compare to GPT-5.6 Sol?
Leads every head-to-head: Frontier-Bench (43.3% vs 34.4%), ARC-AGI-3 (30.2% vs 7.8%), GDPval-AA v2 (1,861 vs 1,736), HLE with tools (64.7%, #1 tracked).
What does Auto Mode do?
Two independent defenses. Input: scans external content for hidden instructions, prepends warnings. Output: Sonnet 4.6 classifier inspects tool calls before execution, blind to the model’s own reasoning. Both must be defeated independently.
Further Reading
- Anthropic — Claude Opus 5 System Card (PDF) — Primary source for all security and benchmark data.
- The Decoder — Opus 5 may have solved browser-based prompt injection — Original reporting with OpenAI admission context.
- Codersera — Claude Opus 5 Benchmarks Explained (2026) — Complete benchmark breakdown with methodology.
- Anthropic Engineering — How we built Claude Code auto mode — Two-layer defense architecture and classifier design.
- XenoSpectrum — Has Claude Opus 5 Solved Prompt Injection? — Full model comparison table and adaptive evaluation results.
- AI Release Tracker — Claude Opus 5 — All 23 tracked benchmark scores.
- Creati.ai — Auto Mode drove browser prompt injection success to zero — Builder’s perspective on enterprise procurement.
- WalletInvestor — Claude Opus 5 reports zero prompt injection rate — Pricing and market implications.