Anthropic reveals 31.5% hijack rate for Opus 4.8 browser agent before safeguards

Nearly one in three attempts to hijack Anthropic’s newest AI browser agent succeeded before safeguards kicked in. That is not a rumor from a red-team Slack channel. It is a number Anthropic printed in its own system card.

The company released the Claude Opus 4.8 system card on May 28, spanning 244 pages and covering four agentic surfaces. The pre-safeguard hijack rate for the browser agent clocked in at 31.5%. To put that in plain terms: if a malicious actor pointed a prompt injection attack at the model while it was browsing the web, the attack worked roughly a third of the time, assuming no defensive layers were active.

The transparency gap across frontier labs

Here’s the thing. That 31.5% figure looks bad in isolation. But Anthropic is the only frontier lab that actually gave security professionals a concrete number to work with this spring.

OpenAI published a prompt injection disclosure that covered only one surface: connectors. Google moved the entire subject out of its model card and into a broader safety framework document, effectively diluting the specificity. Meta shipped no closed-model card at all.

What the safeguards actually do

The 31.5% figure is a pre-safeguard measurement, which is important context. It represents the raw vulnerability surface of the model before Anthropic’s layered defenses engage.

Post-safeguard testing on a related model, Opus 4.5, showed attack success rates dropping to approximately 1%. That is a reduction of roughly 97% from the unprotected baseline.

Prompt injection remains the leading security challenge for AI systems with agentic capabilities. When a model can browse websites, fill out forms, or execute multi-step tasks on a user’s behalf, a successful injection can redirect all of that agency toward an attacker’s goals.

Previous versions of Anthropic’s system cards, including the Opus 4.7 report, also featured quantified injection resistance metrics. The company has been building a track record of publishing these numbers consistently, which makes the data more useful over time as a trend line rather than a single snapshot.

Why this matters for crypto and AI-integrated platforms

The crypto industry is neck-deep in AI agent integrations. Autonomous trading bots, AI-powered portfolio managers, on-chain data analyzers, and DeFi agents that execute transactions based on natural language instructions are all either live or in development across dozens of protocols.

A 31.5% pre-safeguard hijack rate should make every team building these products pause. If your AI agent browses external data sources, parses on-chain content from potentially adversarial smart contracts, or reads user-generated content on forums and social platforms, prompt injection is not a theoretical risk. It is a measured one.

The post-safeguard improvement to around 1% is encouraging, but it carries a caveat. That number comes from Anthropic’s own testing environment. Real-world deployment conditions, where agents interact with messy, uncontrolled web content and adversaries have financial incentives measured in millions, will stress-test those defenses differently than a red-team exercise.

For investors evaluating AI-adjacent crypto projects, the transparency gap between labs is itself a signal. Protocols building on top of Claude models can at least point to published security data and explain their mitigation strategies. Projects relying on models from labs that haven’t published comparable data are asking users to trust a black box.

Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy.