Is indirect prompt injection still a big threat as models get more advanced?

Indirect prompt injection remains a real threat against most models but has dropped sharply on the newest ones, according to Gray Swan's ART and IPI red-team benchmarks: attackers with 15 tries succeeded against Claude Opus 5.5 only 1.0% of the time, versus 4.8% for Claude Opus 5, while GPT-6 Astra fell to 8.5% from 27.0% for GPT-5.6 Sol. Older and rival models fared far worse, with April 2026 ART results showing 45.5% attack success against Gemini 3.1 Pro, 32.5% against GPT-5.4, 21.7% against Claude Opus 4.6 and 6.0% against Claude Opus 4.7. The article also reports that criminals have begun using indirect prompt injection to steal API keys, and that MCP tool descriptions fooled GPT-5 about half the time, a vector the labs do not test.

Is indirect prompt injection still a big threat as models get more advanced? Short answer: not much against the newest models, at least with today's attacks. Elsewhere, it's still a real threat. - Even with 15 tries, attackers beat Opus 5.5 about 1 time in 100. The best from other labs: about 1 in 11 to 1 in 18. Many others: 1 in 4 or worse. Inside the labs model-as-defence - Real attacks planted on the web are still crude and mostly fail. Outside the labs outside-the-labs - Criminals have started using it to steal API keys. Real attackers real-attackers - MCP adds ways in that the labs don't test. Tool descriptions fooled GPT-5 about half the time. MCP safer-in-tool-responses-not-in-tool-descriptions - Attackers who keep trying still win on older models. On the newest ones, only the labs' own tests exist so far, and they rarely got through. Conclusion conclusion If you're building an agentic app: - Benchmark your app with different models and see which ones do the job best. MCP studies ipi-mcp-environment - Then compare which of those are safest. Right now, that looks like the Claude family. Go-to model go-to-model - If you use MCP, only connect servers you trust, and limit what each tool can read and send. Conclusion conclusion Inside the labs: are newer models harder to fool? inside-the-labs-are-newer-models-harder-to-fool Labs often publish a system card alongside major releases: a report on how the model was built and tested. The idea grew out of model cards https://arxiv.org/abs/1810.03993 , proposed by Mitchell et al. in 2018. Each lab keeps its cards in one place: Anthropic https://www.anthropic.com/system-cards , OpenAI https://deploymentsafety.openai.com/ and Google DeepMind https://deepmind.google/models/model-cards/ . Part of that testing comes from Gray Swan https://www.grayswan.ai/ , an outside red-team company. Gray Swan runs public competitions in its Arena https://app.grayswan.ai/arena , where thousands of people try to trick AI models. It keeps the attacks that fool many different models, not just the one they were aimed at, and packs them into a benchmark that labs run before release. The April chart uses its ART benchmark https://arxiv.org/abs/2507.20526 , which covers tool use only. By mid-year, Claude models had largely maxed it out, so the September chart uses its newer, broader IPI benchmark https://arxiv.org/abs/2603.15714 , which adds coding and computer use. April 2026: attackers get 100 tries april-2026-attackers-get-100-tries | Model | Attack success | About 1 time in… | |---|---|---| | Gemini 3.1 Pro | 45.5% | 1 in 2 | | GPT-5.4 | 32.5% | 1 in 3 | | Claude Opus 4.6 | 21.7% | 1 in 5 | | Claude Opus 4.7 | 6.0% | 1 in 17 | In April, an attacker allowed 100 tries per scenario could still trick a lot of models. Against GPT-5.4, the attacker succeeded about 1 time in 3 , and against Gemini 3.1 Pro almost 1 time in 2 . Claude's newest model held up much better: against Opus 4.7, the attacker succeeded 6.0% of the time, down from 21.7% for Opus 4.6. September 2026: a new test, 15 tries september-2026-a-new-test-15-tries | Model | Attack success | About 1 time in… | |---|---|---| | GPT-5.6 Sol | 27.0% | 1 in 4 | | GPT-6 Astra | 8.5% | 1 in 12 | | Claude Opus 5 | 4.8% | 1 in 21 | | Claude Opus 5.5 | 1.0% | 1 in 100 | By September, even with 15 tries, the estimated chance of a successful attack on Opus 5.5 was 1.0% , down from 4.8% for Opus 5. OpenAI improved too: GPT-6 Astra's was 8.5% , down from 27.0% for GPT-5.6 Sol. Newer models are much harder to fool newer-models-are-much-harder-to-fool You can't line up the two charts number for number, because they use different tests. But look inside each chart and the pattern is the same: in every pair below, the newer model's estimated attack success rate was lower than the one it replaced, by roughly 1.5× to 6.5× on these tests, often within a few months. The September gains came on a broader test that adds coding and computer use. | Older → newer model | Before | After | Change | |---|---|---|---| | Gemini 3 Pro Preview → 3.1 Pro April | 75.6% | 45.5% | about 1.7× lower | | GPT-5.2 → GPT-5.4 April | 49.2% | 32.5% | about 1.5× lower | | Claude Opus 4.6 → 4.7 April | 21.7% | 6.0% | about 3.6× lower | | GPT-5.6 Sol → GPT-6 Astra Sept | 27.0% | 8.5% | about 3.2× lower | | Claude Opus 5 → 5.5 Sept | 4.8% | 1.0% | about 4.8× lower | | Claude Fable 5 → 5.1 Sept | 6.5% | 1.0% | about 6.5× lower | What about models from other labs? what-about-models-from-other-labs It varies a lot. In the same September test, the best of them came close to Claude: Gemini 3.8 Flash at 5.5% Opus 5.5 card, p. 85 https://www.anthropic.com/claude-opus-5-5-system-card page=85&zoom=100,0,513 , GPT-6 Astra at 8.5% and Gemini 3.7 Flash at 9.2% , against 4.8% for Claude Opus 5. But six others scored 24% to 60% GPT-6 Astra system card https://deploymentsafety.openai.com/gpt-6-astra prompt-injection . And the gap only runs one way. In Gray Swan's 2025 competition, the attacks that managed to break Claude Opus 4.5 went on to work against the other models 44–81% of the time https://arxiv.org/pdf/2603.15714 page=12 , while attacks that broke the weaker models rarely got past the stronger ones. | Model | Fooled within 15 tries | |---|---| | Muse Spark 1.2 | 24.2% | | Qwen 3.8 † | 28.6% | | GLM-5.3 † | 31.5% | | Grok 4.6 | 51.8% | | Kimi K3 | 52.7% | | DeepSeek V4 Pro † | 60.1% | | Gemini 3.7 Flash for reference | 9.2% | | GPT-6 Astra for reference | 8.5% | | Gemini 3.8 Flash for reference, Opus 5.5 card https://www.anthropic.com/claude-opus-5-5-system-card page=85&zoom=100,0,513 | 5.5% | | Claude Opus 5 for reference | 4.8% | So the labs' own numbers point one way: prompt injection is getting harder to pull off, and fast, especially against the newest models from Anthropic and OpenAI. Does another benchmark agree? does-another-benchmark-agree Lakera, a security company, ran its own test of 34 models in Breaking Agent Backbones https://arxiv.org/pdf/2510.22620v2 page=1 ICLR 2026 https://iclr.cc/virtual/2026/poster/10007758 . It works differently from Gray Swan's, so instead of lining up the numbers, it's more useful to ask whether the two reach the same conclusions. | Question | Lakera | Gray Swan | Agree? | |---|---|---|---| | Who resists best? | Claude models; closed models beat open ones | Claude and GPT, well ahead of the rest | Yes | | Does a bigger model help? | Not consistently | Slightly, within Claude; family matters more | Mostly | | Does reasoning help? | Usually | Mixed, on different models | Can't tell | Who resists best: both point to the same models who-resists-best-both-point-to-the-same-models In Lakera's test, the most secure models were Claude Haiku 4.5 and Sonnet 4.5 https://arxiv.org/pdf/2510.22620v2 page=8&zoom=100&search=The%20most%20secure%20models&phrase=true , and closed-weight models generally beat open-weight ones p. 8 https://arxiv.org/pdf/2510.22620v2 page=8&zoom=100&search=Closed%20weights%20systems%20generally%20outperform&phrase=true . Gray Swan's 2025 competition found the same split: Claude and GPT families stand out with notably lower ASRs compared to other model families p. 9 https://arxiv.org/pdf/2603.15714 page=9&zoom=100&search=Claude%20and%20GPT%20families%20stand%20out&phrase=true . Model size: not a reliable lever in either model-size-not-a-reliable-lever-in-either Both tests compared Claude Haiku 4.5 and Sonnet 4.5 with reasoning off, and they put them in opposite order. In Lakera's test, larger models without reasoning showed no significant performance advantage over their smaller counterparts, and occasionally performed worse p. 8 https://arxiv.org/pdf/2510.22620v2 page=8&zoom=100&search=showed%20no%20significant%20performance%20advantage&phrase=true , and Sonnet 4.5 did worse than the smaller Haiku 4.5 Figure 9, p. 28 https://arxiv.org/pdf/2510.22620v2 page=28 . With reasoning on, bigger models did slightly better https://arxiv.org/pdf/2510.22620v2 page=8&zoom=100&search=modest%20improvements&phrase=true . Gray Swan, which also ran with thinking off https://arxiv.org/pdf/2603.15714 page=14&zoom=100&search=disable%20thinking&phrase=true , found the bigger model slightly ahead: Opus 4.5 at 0.5% , Sonnet 4.5 at 1.0% and Haiku 4.5 at 1.3% p. 9 https://arxiv.org/pdf/2603.15714 page=9 . But all three sit within about a point, and the authors conclude that robustness depends more on model family and its training recipe than the raw capability of models p. 10 https://arxiv.org/pdf/2603.15714 page=10&zoom=100&search=training%20recipe&phrase=true . Reasoning: no fair comparison yet reasoning-no-fair-comparison-yet Lakera found that adding reasoning generally improves the security , and that only the tiny model versions exhibit decreased security as reasoning increases p. 8 https://arxiv.org/pdf/2510.22620v2 page=8 . Gray Swan's April chart was mixed: turning thinking on helped four models and hurt four others, including Opus 4.6 and Opus 4.7 p. 83 https://www.anthropic.com/claude-opus-4-7-system-card page=83&zoom=100,0,562 . But it tested different models from Lakera's, so the two can't be set side by side. By September, Gray Swan ran every model with thinking on https://www.anthropic.com/claude-opus-5-5-system-card page=85&search=All%20models%20use%20extended%20thinking&phrase=true , so its results compare models on the same footing. Should Claude be your go-to model for agents? go-to-model Yes, on this evidence. Claude leads in the labs' charts and in Lakera's test. But Anthropic's own report flags two things to check before you rely on it: - Check which model actually answers. When a cyber-safety check triggers, Opus 5.5 hands the request to the older Opus 4.8. In Anthropic's adaptive coding test, that happened for about two thirds of requests, and attacks got through on most of those https://www.anthropic.com/claude-opus-5-5-system-card page=88&search=85.73%25&phrase=true . None got through on the requests Opus 5.5 answered itself. - Check how outside text reaches the model. Claude is trained to distrust instructions that arrive in tool results. Text pasted into the user's own message is a weaker spot: an early Opus 5.5 build followed planted instructions there about half the time https://www.anthropic.com/claude-opus-5-5-system-card page=125&search=in%2052%25%20of%20attempts&phrase=true . Retraining cut that to about 2%, and Anthropic's own apps add fixes that bring it to zero https://www.anthropic.com/claude-opus-5-5-system-card page=126&search=did%20not%20follow%20any&phrase=true . If you build on the API, you may need similar fixes of your own. So Claude is a strong default for agents, as long as you check which model actually answers and how outside text reaches it. Takeaway Two benchmarks built in different ways agree on the big picture: model family and training matter more than size. Neither reasoning nor a bigger model reliably helps, so test the model inside your own agent. MCP: more ways in than the labs test mcp-more-ways-in-than-the-labs-test The lab charts only test instructions hidden in the content an agent reads, like web pages, files and tool results. MCP gives attackers more ways in. They can hide instructions in a tool's description, pass them through tool arguments, or ship a server with malicious code. The studies below test these paths, but on older models like GPT-5 and Sonnet 4.5. So they don't show the lab numbers are wrong, just what the labs leave untested. | Paper and what it tested | Did the model stop the attack? | What else could help? | |---|---|---| | Security Research | | | | VIPER-MCP https://arxiv.org/pdf/2605.21392v2 page=1 12 Aug 2026 v2 · arXiv preprint Attack enters through: prompts that become tool arguments. Test checks: can the agent exploit a bug in an MCP server? Method, Sections 2–3 https://arxiv.org/pdf/2605.21392v2 page=3 . The authors report 106 new bugs across 39,884 repositories https://arxiv.org/pdf/2605.21392v2 page=10&zoom=100&search=Takeaway%201&phrase=true and 67 assigned CVEs, though the CVE IDs are placeholders https://arxiv.org/pdf/2605.21392v2 page=17 . | Neither Haiku 4.5 nor GPT-5.4-mini reliably stopped exploitation. With GPT-5.4-mini generating and assessing attacks, bugs were triggered on 83 of 130 servers through Haiku, and 84 through GPT-5.4-mini https://arxiv.org/pdf/2605.21392v2 page=13&zoom=100&search=TABLE%204&phrase=true . These count servers exploited, not success per prompt. Direct attacker prompts were allowed, so this isn't comparable to Gray Swan's indirect-injection scores. | Fix the tools too. The authors recommend parameterized command invocation, allowlist validation, and path canonicalization with confinement https://arxiv.org/pdf/2605.21392v2 page=13&zoom=100&search=parameterized%20invocation&phrase=true . They don't test these defences. The study covers three bug classes in Python and JavaScript/TypeScript. It doesn't establish safety across other tools or deployments. | | Peer Reviewed | | | | AgentBound https://arxiv.org/pdf/2510.21236v3 page=1 24 Apr 2026 v3 · FSE 2026 https://doi.org/10.1145/3808103 Attack enters through: injected instructions or malicious MCP server code. Test checks: do enforced permissions stop unauthorized file, network or system access? Section 4.2 https://arxiv.org/pdf/2510.21236v3 page=15 . Not all attacks use IPI: server code can act maliciously without tricking the model. | No model-resistance comparison. GPT-5-mini and GPT-5 help generate permission policies; they aren't compared as defenders. Section 4.1 https://arxiv.org/pdf/2510.21236v3 page=12 . Unlike Gray Swan's IPI tests, this evaluates whether a sandbox contains harmful actions, rather than whether the model rejects injected instructions. | Enforced permissions blocked nine attacks that exceeded them. But redirected transfers and SQL injection still got through https://arxiv.org/pdf/2510.21236v3 page=16 when they used permitted resources. The security tests used a small set of malicious servers and manually written or checked policies. The result depends on what those policies allow; it isn't general protection against IPI. | | MCP Security Bench MSB https://arxiv.org/pdf/2510.15994v2 page=1 2025; revised 24 Mar 2026 v2 · ICLR 2026 https://iclr.cc/virtual/2026/poster/10008216 Attack enters through: tool names, descriptions, parameters, responses and retrieved content. Test checks: did the attack work, and could the agent still do the user's task? Method, pp. 7–8 https://arxiv.org/pdf/2510.15994v2 page=7&zoom=100&search=Evaluation%20Metrics&phrase=true . Some checks are limited: one “leakage” test only asks for the model's name. Table 9 https://arxiv.org/pdf/2510.15994v2 page=29&zoom=100&search=Table%209&phrase=true . | GPT-5 had the best combined score for usefulness and resistance. But results varied: 0.33% attack success for fake user messages versus 48.85% for poisoned tool descriptions https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=GPT-5&phrase=true . A low attack rate alone can hide a model that struggles to use tools. The combined score https://arxiv.org/pdf/2510.15994v2 page=10&zoom=100&search=NRP&phrase=true rewards useful work too; it doesn't mean the model is safe. | A tested defence blocked more attacks, but also more useful work. With the MCIP safety checker, average attack success fell from 40.35% to 28.69% https://arxiv.org/pdf/2510.15994v2 page=10&zoom=100&search=Table%204&phrase=true ; task completion fell from 56.50% to 48.91%. The combined score improved slightly on average, but fell for GPT-5. | | Parasites in the Toolchain https://arxiv.org/pdf/2509.06572v5 page=1 8 Sept 2025; revised 1 May 2026 v5 · IEEE S&P 2026 https://sp2026.ieee-security.org/accepted-papers.html :~:text=Parasites%20in%20the%20Toolchain Attack enters through: retrieved pages or messages. Test checks: did private data reach the attacker's destination? With Cursor Auto allowed to act without approval, 9 of 10 tested tool combinations leaked data https://arxiv.org/pdf/2509.06572v5 page=12&zoom=100&search=9%20of%2010&phrase=true at least once in ten tries each. | Yes, for GPT-5 and Sonnet 4.5: neither leaked data in 75 attempts each https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true . DeepSeek R1 and Gemini 2.5 Flash often did. This comparison used one tool combination and three versions of the attack, repeated across five apps. It shows these models held up in this test, not that they can stop every attack. | The authors recommend limiting what tools can read and send https://arxiv.org/pdf/2509.06572v5 page=14&zoom=100&search=Defense%20Mechanism&phrase=true , treating retrieved text as data rather than orders, and watching for suspicious sequences of actions. They suggest these protections but don't test how well they work. | | MCPTox https://arxiv.org/pdf/2508.14925 page=1 19 Aug 2025 · AAAI 2026 https://ojs.aaai.org/index.php/AAAI/article/view/40895 Attack enters through: tool descriptions, placed in the system prompt. Test checks: did the agent choose a harmful tool call or change its arguments? Method, pp. 5–6 https://arxiv.org/pdf/2508.14925 page=5&zoom=100&search=LLM%20Agent%20Evaluation&phrase=true . | Reasoning sometimes made things worse. For Qwen3-8B, turning it on raised attack success from 14.0% to 41.8% https://arxiv.org/pdf/2508.14925 page=5&zoom=100&search=Table%202&phrase=true . Rates count valid outputs only. The authors conclude that more capable models, larger ones or those with reasoning on, are often more susceptible, though their Table 2 isn't consistent: Qwen3-14B 27.1% did better than both 8B 41.8% and 32B 58.5% . GPT-5 and Sonnet 4.5 weren't tested. This challenges “more capable means safer,” without overturning their results in the other paper. | No added defence was tested. The authors call for security checks before tools run https://arxiv.org/pdf/2508.14925 page=7&zoom=100&search=pre-execution&phrase=true . Malicious instructions in one tool's description can trick the agent into misusing another tool, even if it never calls the tool containing those instructions. | Same models, three sets of results same-models-three-sets-of-results Older system cards from Anthropic and OpenAI tested some of the same models these studies used. They report two kinds of results, the labs' own fixed tests and Gray Swan's red-team benchmark, so we can put all three side by side. | Model | Lab's own test | Gray Swan red-teamers, 10 tries reported by the lab | Independent MCP research | |---|---|---|---| | Claude 3.7 Sonnet Released Feb 2025 | Stopped 74% of injections 3.7 card, p. 13 https://www.anthropic.com/claude-3-7-sonnet-system-card page=13&search=compared%20to%2074%25%20with%20no%20mitigations&phrase=true Feb 2025 | Fooled in 64.5% of scenarios Sonnet 4.5 card, p. 28 <https://www.anthropic.com/claude-sonnet-4-5-system-card page=29&search=Agent%20Red%20Teaming%20 ART %20benchmark%20measuring&phrase=true Sep 2025 | Fooled by poisoned tool descriptions 34% of the time MCPTox, Table 2 https://ojs.aaai.org/index.php/AAAI/article/view/40895 Aug 2025 | | Claude Sonnet 4 Released May 2025 | Stopped 91% in its MCP test Sonnet 4.5 card, p. 29 <https://www.anthropic.com/claude-sonnet-4-5-system-card page=30&search=Model%20Context%20Protocol%20 MCP %20evaluation&phrase=true Sep 2025 | Fooled in 65.5% of scenarios Sonnet 4.5 card, p. 28 <https://www.anthropic.com/claude-sonnet-4-5-system-card page=29&search=Agent%20Red%20Teaming%20 ART %20benchmark%20measuring&phrase=true Sep 2025 | Fooled 40–67% of the time, depending on where the attack hid MSB, Table 3 https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true Mar 2026 | | Claude Sonnet 4.5 Released Sep 2025 | Stopped 92% in its MCP test Sonnet 4.5 card, p. 29 <https://www.anthropic.com/claude-sonnet-4-5-system-card page=30&search=Model%20Context%20Protocol%20 MCP %20evaluation&phrase=true Sep 2025 | Fooled in 53.6% of scenarios Sonnet 4.5 card, p. 28 <https://www.anthropic.com/claude-sonnet-4-5-system-card page=29&search=Agent%20Red%20Teaming%20 ART %20benchmark%20measuring&phrase=true Sep 2025 | Leaked nothing in 75 tries Parasites https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true May 2026 | | GPT-5 Released Aug 2025 | Resisted 99% of injections in tool outputs GPT-5 card, p. 11 https://cdn.openai.com/gpt-5-system-card.pdf page=12&search=Tool%20calling%20prompt%20injections&phrase=true Aug 2025 | Fooled in 56.8% of scenarios GPT-5 card, p. 21 https://cdn.openai.com/gpt-5-system-card.pdf page=22&search=Figure%208&phrase=true Aug 2025 | Held up against fake tool responses, but fooled through tool descriptions 49% of the time MSB, Table 3 https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true Mar 2026 Leaked nothing in 75 tries Parasites https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true May 2026 | Dates are when each result was published. For the MSB and Parasites papers, that's the version the numbers come from. Across MSB's injections in tool descriptions, tool responses and retrieved content, leaving out a test that only asks for the model's name. Gray Swan later re-graded its benchmark, so newer cards show lower numbers for the same models. These are the earliest published figures. The labs publish both kinds of numbers, often in the same report. Their own fixed tests stopped most injections. Gray Swan's red-teamers, given 10 tries, got through more than half the time on every one of these models. The independent MCP studies land in between, and where the attack hides decides the result. GPT-5 held up against fake tool responses, just as OpenAI reported, but tool descriptions fooled it about half the time. The labs' own tougher tests agree. Once attackers could adapt, Sonnet 4.5 https://www.anthropic.com/claude-opus-4-5-system-card page=61&search=Shade%20indirect%20prompt%20injection&phrase=true and GPT-5.4 were fooled far more often. GPT-5.4 blocked 99.8% of OpenAI's fixed connector attacks GPT-5.6 card https://deploymentsafety.openai.com/gpt-5-6/prompt-injection but only 93.954% from its automated red-teamer, GPT-Red GPT-6 Astra card, Figure 4, printed p. 18 https://deploymentsafety.openai.com/gpt-6-astra prompt-injection . As Anthropic puts it, fixed tests can provide a false sense of security Opus 4.5 card, p. 60 https://www.anthropic.com/claude-opus-4-5-system-card page=60&search=false%20sense%20of%20security&phrase=true . The headline lab numbers are the best case, not the worst. Safer in tool responses, not in tool descriptions safer-in-tool-responses-not-in-tool-descriptions Splitting the same results by where the attack hid makes the pattern clearer. Each number is the share of attacks that worked, so lower is better. | Model | Lab's own test | Fake tool responses | Retrieved content | Tool descriptions | |---|---|---|---|---| | Claude 3.7 Sonnet | 26% https://www.anthropic.com/claude-3-7-sonnet-system-card page=13&search=compared%20to%2074%25%20with%20no%20mitigations&phrase=true | not tested | not tested | 34% https://ojs.aaai.org/index.php/AAAI/article/view/40895 | | Claude Sonnet 4 | 9% <https://www.anthropic.com/claude-sonnet-4-5-system-card page=30&search=Model%20Context%20Protocol%20 MCP %20evaluation&phrase=true | 47–66% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true | 40% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true | 67% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true | | Claude Sonnet 4.5 | 8% <https://www.anthropic.com/claude-sonnet-4-5-system-card page=30&search=Model%20Context%20Protocol%20 MCP %20evaluation&phrase=true | not tested | 0 of 75 https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true | not tested | | GPT-5 | 1% https://cdn.openai.com/gpt-5-system-card.pdf page=12&search=Tool%20calling%20prompt%20injections&phrase=true | 0.3–1.3% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true | 30% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true , 0 of 75 https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true | 49% https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=Table%203&phrase=true | GPT-5, the newest model here, shows the pattern most clearly. Fake tool responses almost never fooled it, which matches OpenAI's own number. Instructions hidden in retrieved content worked 30% of the time in one study, and instructions hidden in tool descriptions worked about half the time. Older models like Sonnet 4 were fooled through every path. That lines up with what the labs say they train for. Anthropic defines prompt injection as instructions that arrive through tool results https://www.anthropic.com/claude-opus-5-5-system-card page=123&search=We%20define%20indirect%20prompt%20injections&phrase=true , and OpenAI says it teaches its models to ignore prompt injections in web or connector contents GPT-5 card, p. 10 https://cdn.openai.com/gpt-5-system-card.pdf page=11&search=ignore%20prompt%20injections%20in%20web%20or%20connector%20contents&phrase=true . None of the system cards from either lab report testing tool descriptions. So tool responses are the safer path, but attackers have other ways in, and nothing in the labs' reports shows even the newest models are trained or tested against them. Takeaways - Tool responses are the safer path. The newest models rarely fall for injections there, in the labs' own tests and in some independent ones https://arxiv.org/pdf/2509.06572v5 page=13&zoom=100&search=GPT-5%20and%20Claude-4.5-Sonnet&phrase=true . - Tool descriptions and retrieved content are not. GPT-5 was fooled about half the time https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=GPT-5&phrase=true through tool descriptions, and no lab reports testing that path. - The model is only one layer. Fallback routing https://www.anthropic.com/claude-opus-5-5-system-card page=88&search=85.73%25&phrase=true and permissions agentbound matter too. Outside the labs: how real is the threat? outside-the-labs-how-real-is-the-threat The charts above use attacks written for a test. Two 2026 studies looked for injections people have actually planted, which lets us ask: would today's models have stopped them? On the open web on-the-open-web Indirect Prompt Injection in the Wild https://arxiv.org/pdf/2604.27202v1 page=1 CISPA, arXiv preprint scanned 1.2 billion web addresses from an October 2025 Common Crawl snapshot, plus Shodan and Censys. Most injections sit where only machines look, such as headers, comments and metadata, and most reuse a small set of templates that tell the model to drop its task https://arxiv.org/pdf/2604.27202v1 page=2&zoom=100&search=54%20prompt%20templates&phrase=true . Google ran its own scan https://blog.google/security/prompt-injections-web/ of Common Crawl and found the same thing. Injections are growing, but most are pranks and experiments, not the advanced attacks researchers have published. Google reads that as a sign that attackers haven't put that research to use yet https://blog.google/security/prompt-injections-web/ :~:text=attackers%20have%20yet%20not%20productionized . | | CISPA preprint | Google blog post | |---|---|---| | Searched | 1.2B web addresses, Oct 2025 crawl, plus Shodan and Censys | Several Common Crawl snapshots, 2–3B pages each | | Found | 15.3K confirmed injections on 11.7K pages | A 32% relative rise in malicious injections, Nov 2025 → Feb 2026 | | How advanced? | Mostly reused templates that tell the model to drop its task | Mostly pranks and experiments; little advanced work | Would today's models have stopped them? Mostly would-today-s-models-have-stopped-them-mostly The CISPA team took 100 of these real injections and tried them on 13 models. The small models were fooled the most. GPT-5.4, the newest model they tested, was almost never fooled. That's the same GPT-5.4 that Gray Swan fooled about 1 time in 3 in April. The difference is the attacker: Gray Swan's red-teamers tune their attacks and get 100 tries, while a web injection is a fixed template with one shot. Anthropic says as much: simple attacks do not succeed anymore Opus 5.5 System Card, p. 123 https://www.anthropic.com/claude-opus-5-5-system-card page=123&search=simple%20attacks%20do%20not%20succeed%20anymore&phrase=true . For now, the lab tests are the harder bar. Two caveats: some models spotted an injection and followed it anyway https://arxiv.org/pdf/2604.27202v1 page=11&zoom=100&search=six%20cases&phrase=true , and the authors expect attacks to become more adaptive and targeted https://arxiv.org/pdf/2604.27202v1 page=12&zoom=100&search=Static%20Today&phrase=true . What about targeted attacks that never touch the web? what-about-targeted-attacks-that-never-touch-the-web Most software doesn't read the open web, but anything a user can supply still reaches the model. Measuring Real-World Prompt Injection Attacks in LLM-based Resume Screening https://www.usenix.org/system/files/usenixsecurity26-zhang-mohan.pdf page=2 USENIX Security 2026 https://www.usenix.org/conference/usenixsecurity26/presentation/zhang-mohan checked about 200,000 real resumes from a hiring platform. About 1% hid an injection https://www.usenix.org/system/files/usenixsecurity26-zhang-mohan.pdf page=2&search=approximately%201%25%20of%20resumes&phrase=true , and the number keeps rising https://www.usenix.org/system/files/usenixsecurity26-zhang-mohan.pdf page=10&search=absolute%20number%20of%20malicious%20resumes&phrase=true . Most of them weren't instructions at all, and 9 in 10 were just hidden data, like invisible lists of skills meant to game keyword matching. The paper didn't test whether these worked https://www.usenix.org/system/files/usenixsecurity26-zhang-mohan.pdf page=15&search=does%20not%20assess&phrase=true . Takeaway Real injections are out there and growing, but for now they're crude, and frontier models mostly ignore them. Your software doesn't need to browse the web to be exposed. So, have real attackers used it yet? so-have-real-attackers-used-it-yet Yes. Two reports from September 2026, one from Anthropic https://www.anthropic.com/threat-intelligence-report-september-2026 and one from Google's threat intelligence team https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai GTIG , describe criminals using prompt injection against real companies. Every group they name was after money. Neither report shows government hackers doing it. Who used it, and for what who-used-it-and-for-what | Attacker | When | What they did | What they got or wanted | |---|---|---|---| | GTG-50020 Anthropic · Russian-speaking criminals | Dec 2025 – Aug 2026 no exact date ; reported 10 Sep 2026 https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=1 | Slipped instructions https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=30&search=injecting%20malicious%20instructions&phrase=true into an AI company's automated testing sandbox, which then handed over the keys it held. | The company's live AI API keys. They then went after about 30 AI companies in four days https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=31&search=roughly%20thirty%20AI%20companies&phrase=true , trying to reach an unreleased Claude model. That failed, and Anthropic itself was never breached. | | Several unnamed groups Anthropic | Dec 2025 – Aug 2026 no exact date ; reported 10 Sep 2026 https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=1 | Used prompt injection https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=29&search=used%20prompt%20injection%20to%20exfiltrate&phrase=true on AI apps built on LiteLLM, a popular tool for connecting to AI models. | The apps' live API keys. Anthropic lists this among common criminal attacks https://www-cdn.anthropic.com/e50be2e51e7695dc4b1366a37a245a597377d3b5/Anthropic-Detecting-and-countering-091026.pdf page=12&search=prompt%20injection%20of%20LiteLLM&phrase=true . | | UNC6780 TeamPCP GTIG · criminals | Active since March 2026 https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai :~:text=Since%20March%202026 no date for the injection tricks ; reported 8 Sep 2026 | Poisoned popular code packages, then hid instructions in project folders .claude/ , .vscode/ , .cursor/ that told coding assistants to run the attacker's scripts https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai :~:text=Behavioral%20Manipulation%20through%20Prompt%20Injection . | Passwords and keys, which they sold or passed to extortion gangs. In one case, a gang took a copy of a company's private AI code https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai :~:text=exfiltrated%20a%20copy%20of%20this%20AI%20repository . | TeamPCP also used it against defenders. Its malware starts with fake "SYSTEM OVERRIDE" text asking for weapons instructions, likely so AI security scanners refuse to read on https://cloud.google.com/blog/topics/threat-intelligence/from-prompting-to-autonomy-the-evolution-of-adversarial-ai :~:text=Prompt%20Injection%20to%20Defeat%20LLM%20Security%20Scanners and miss the malicious code below. Conclusion: is indirect prompt injection still a threat? conclusion-is-indirect-prompt-injection-still-a-threat Not much against the newest models, at least with today's attacks. That could change if someone finds a new kind of attack. It's still a real threat with many other labs' models six were fooled 24–60% of the time https://deploymentsafety.openai.com/gpt-6-astra prompt-injection , when a request falls back to a weaker model go-to-model , and when the agent can reach keys and passwords real-attackers . Simple attacks mostly fail now. In Anthropic's words, simple attacks do not succeed anymore p. 123 https://www.anthropic.com/claude-opus-5-5-system-card page=123&search=simple%20attacks%20do%20not%20succeed%20anymore&phrase=true . But attackers who keep trying still get through. In Microsoft's LLMail-Inject challenge, 16.6% of teams https://arxiv.org/pdf/2506.09956v1 page=7&search=stacking%20all%20defenses&phrase=true beat every defence stacked together. Nasr, Carlini and others broke 12 published defences, most over 90% of the time https://arxiv.org/pdf/2510.09023v1 page=1&search=above%2090%25%20for%20most&phrase=true . And in Gray Swan's competition, attackers kept breaking every model at a steady rate; the authors say even the more robust models remain susceptible under sustained adversarial pressure p. 9 https://arxiv.org/pdf/2603.15714v1 page=9&search=remain%20susceptible%20under%20sustained%20adversarial%20pressure&phrase=true . All of this was on older models. On the newest ones, only the labs' own tests exist so far Opus 5.5 https://www.anthropic.com/claude-opus-5-5-system-card page=88&search=none%20of%20the%202%2C872&phrase=true , GPT-6 Astra https://deploymentsafety.openai.com/gpt-6-astra prompt-injection , and they rarely got through. MCP is where the picture is least settled. The labs train and test their models on instructions hidden in tool results, and that's where the newest models hold up. But MCP gives attackers other ways in. Tool descriptions fooled GPT-5 about half the time https://arxiv.org/pdf/2510.15994v2 page=9&zoom=100&search=GPT-5&phrase=true , and neither lab's system cards test that path safer-in-tool-responses-not-in-tool-descriptions . So when you connect an MCP server, you're trusting what its tools say about themselves, not just what they return. The studies point to the same fixes. Limit what each tool can read and send Parasites https://arxiv.org/pdf/2509.06572v5 page=14&zoom=100&search=Defense%20Mechanism&phrase=true , check tool calls before they run MCPTox https://arxiv.org/pdf/2508.14925 page=7&zoom=100&search=pre-execution&phrase=true , and enforce permissions AgentBound agentbound , knowing they won't stop attacks that stay inside what's allowed. Hope this helped -- End