Prompt Injection Now Has a Number: 31.5% Agent Hijack

For years the question “how often does prompt injection actually work?” got the same non-answer: it depends. On 28 May 2026, Anthropic put a number on it. Its Claude Opus 4.8 system card reports that a browser-using AI agent was hijacked by an injected instruction 31.5% of the time with no safeguards, and 0.5% of the time once safeguards were on. Prompt injection stopped being a vibe and became a metric you can hold a vendor to.

The absence of a number is where risk hides. You cannot put ‘it depends’ on a risk register, and you cannot tune what you refuse to measure. A 31.5% attack-success-rate is uncomfortable to read and far more useful than a page of reassurance. Below is what the figure measures, why the 0.5% matters more, and how to drive your own agent’s number down.

What the 31.5% Actually Measures

The 31.5% is an attack-success-rate (ASR): the share of adversarial attempts that successfully hijacked the agent. Anthropic measured it on Claude Opus 4.8 in a browser-use setting, with extended thinking on and no safeguards applied, against a held-out set of injection attacks. It is the rate at which a malicious instruction hidden in a web page made the agent take an action it should have refused.

Browser use is close to the worst case for a reason. The agent reads attacker-controlled content, a web page, an email, a document, and that content sits in the same context window as its real instructions. When the boundary between “data to read” and “commands to obey” is thin, a paragraph buried in a page can redirect the whole task. The configuration changes the exposure sharply: Anthropic reports a far lower rate in a coding tool-use setting, and the card is explicit that the number moves with the harness, the safeguards, and the threat model.

The Number That Matters More Is 0.5%

The headline scares; the second number instructs. Safeguards cut the browser-use ASR from 31.5% to 0.5%, more than a sixtyfold reduction. That gap is the entire argument for defence in depth. The model on its own is not your control. The classifiers, monitors, and policy layers wrapped around it are what turn a one-in-three failure into a one-in-two-hundred one.

Read the last row carefully. A 0.5% hijack rate is not zero. Run an agent through thousands of actions a day and 0.5% is a steady trickle of successful attacks, not an edge case you can wave away. Residual risk stays residual until you decide what an attacker can actually do once they win one of those coin flips.

Why a Published Number Is the Real Story

The figure matters less than the fact that a frontier lab printed it. For the first time you can compare models on injection resistance, set a threshold in procurement, and demand the same disclosure from every other vendor. Anthropic also reported a red-team metric where Opus 4.8 scored worse than its predecessor, and that willingness to publish a regression is what makes the rest of the card worth trusting.

So make it your buying question. Ask any agent vendor for an attack-success-rate under injection, with the harness and safeguards stated. If they cannot give you one, they have not measured it, which means they cannot tell you how exposed your agents are. The same discipline applies inside your own stack, which is why an evaluation harness you can test an AI system with before production is the foundation, not an afterthought.

How to Drive Your Own Agent’s Number Down

The sixtyfold drop in the card came from layered safeguards, not a smarter base model. You build the same way: assume the model will occasionally be fooled, and make that failure cheap.

Treat retrieved content as data, never as instructions

Most injections arrive inside content the agent was asked to read. Keep external text in a separate channel from your instructions, mark it as untrusted, and stop concatenating page text straight into the command context. This is the same boundary that protects a retrieval pipeline, covered in securing RAG pipelines against prompt injection.

Scope tools to the task, then deny egress by default

A browsing agent has no reason to also hold shell access and your secrets. Give each agent the narrowest tool set the job needs, and put a default-deny egress policy around the runtime so a hijacked action has nowhere to send what it steals. The runtime version of this is the same hardening I described for self-hosted AI infrastructure: drop everything, add back only what is justified.

Put a human in front of irreversible actions

An injected instruction that can summarise a document is an annoyance. One that can delete a repository, send a payment, or email a customer list is an incident. Gate every irreversible or high-impact action behind explicit human approval, so the 0.5% that gets through still cannot do the thing you most fear. The orchestration trade-offs behind that gate are in what breaks in agent orchestration at production scale.

What I Would Do This Week

If you run agents that read anything they did not author, here is the sequence I would work through, each step useful on its own:

1. Pick your highest-impact agent and write down exactly what it can do if hijacked. That blast radius is your real risk, not a model’s benchmark.
2. Separate external and retrieved content from your instructions, and stop treating page text as commands.
3. Put a human approval gate in front of every irreversible action.
4. Wrap the agent runtime in a default-deny egress policy with an explicit allow-list.
5. Write twenty injection test cases from your own domain and measure your ASR. Now you have a number of your own.
6. Re-run those tests on every model and prompt change, because a number only helps once you watch it move.

Closing

Prompt injection has sat at the top of the OWASP Top 10 for LLM applications since 2023, and it still does. What changed in May 2026 is not the threat. It is that we can finally measure our exposure to it instead of debating it. Take the method Anthropic published, point it at your own agents, and treat the number that comes back as the start of the work rather than the end of it.

Related reading: see securing RAG pipelines against prompt injection, how the agent skill marketplace got poisoned, securing self-hosted AI infrastructure, and what breaks in agent orchestration at production scale.