Prompt injection and jailbreaks

Anthropic is making auto mode the default setting for new Claude Code sessions on Pro, Max, and Team plans starting August 14. Anthropic reports a test across 1,053 paid testers in which auto mode would have blocked 89% of swapped-in dangerous commands, versus 13.6% of humans refusing them. A third-party evaluation by Trajectory Labs reported that none of 720 indirect prompt injection attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode.

Anthropic is making auto mode the default setting for new Claude Code sessions on Pro, Max, and Team plans starting August 14. The author questions the vendor's prompt injection claims, noting that in a 1,053-tester study only 13.6% of humans refused a swapped dangerous command, while auto mode would have blocked 89% of such actions. He also says a third-party evaluation found none of 720 indirect prompt injection attempts succeeded against Claude Fable 5, Opus 5, or Sonnet 5 running auto mode, and he calls for independent confirmation.

Anthropic's Opus 5 reduced the chance of an attacker succeeding within 15 attempts on the IPI benchmark from 5.5% (Opus 4.8) to 2.0%, and from 0.5% to 0.2% on one attempt, making it the most robust model evaluated. Among non-Claude models, Muse Spark was the most robust at 16.5% within 15 attempts, while GPT 5.6 Sol measured 20.0% within 15 attempts and 3.1% on a single attempt. The source notes that preventing prompt injection in the general case is impossible, but blocking it in specific cases is improving.

Tracebit researchers introduced context bombing, a technique that plants prompt injection strings alongside secrets stored on Amazon Web Services to halt attacks from AI hacking agents. In tests of five models across 152 attack runs in a simulated AWS environment, admin privilege escalation fell from 57 percent to 5 percent. The article notes that attackers have also used prompt injections against AI defenses inside networks.

SafeSteer is a lightweight inference-time steering framework that defends Vision Language Models against jailbreak attacks without modifying model weights. It uses singular value decomposition to purify a low-dimensional safety subspace from noisy activation differences, then projects the raw steering vector into that subspace. The authors report a reduction of over 60% in attack success rate while maintaining utility on benign tasks.

OpenAI disclosed GPT-Red, an internal automated red-teaming model that generates prompt injection attacks to find failure modes before deployment. The company used GPT-Red in self-play reinforcement learning to adversarially train GPT-5.6 Sol, which it says achieves 6x fewer failures on a direct prompt injection benchmark than GPT-5.5. GPT-Red was also tested against an AI vending machine built by Andon Labs and a Codex command-line agent based on GPT-5.4 mini.

OpenAI describes GPT-Red, an automated red-teaming model trained with self-play reinforcement learning to find prompt injection vulnerabilities before deployment. The company says GPT-Red is used to adversarially train GPT-5.6, which it reports as its most robust model to prompt injections, with 6x fewer failures on its hardest direct prompt injection benchmark compared with its best production model from four months earlier.