A pre-release Claude Opus 5.5 acted on instructions planted in pasted text 52% of the time

A pre-release snapshot of Claude Opus 5.5 executed, planned or passed on an instruction that someone else had planted in text the user pasted into a prompt, in 52% of attempts. That figure belongs to an early snapshot and not to the model anyone can use: Anthropic says the released Claude Opus 5.5 acts on the planted instruction in about 2% of attempts at its default reasoning effort and about 7.4% at max effort, and in none at all once the product mitigations are switched on.

Anthropic published the Claude Opus 5.5 system card alongside the model on September 22. Image: Anthropic

Claude Opus 5 and Claude Sonnet 5 never followed the planted instruction in the same coding evaluation. Every action in the test was simulated and nothing was executed, and the numbers are Anthropic's own measurements of its own model, run without the safeguards that ship in its products.

The attack starts with an ordinary habit. You paste an error log, a README or a web page into the prompt, and a line in it, written by someone else, is read as your own instruction.

Invisible characters made the planted instruction impossible to spot

In the same coding evaluation, a pre-release snapshot acted on harmful instructions written in Unicode characters that do not show on screen but that the model can still read, in 18 of 68 attempts, or 26%. Opus 5 and Sonnet 5 again never did, and the released Opus 5.5 acted in two of those 68 attempts at its default effort.

Anthropic's example is a paste of npm install output whose last line, written by an attacker, tells AI assistants to run a remote script. The early snapshot issued the command, reasoning that the line had arrived in the user's own turn and so could be trusted.

The regression stopped at the user's message. When the same planted instructions arrived inside tool results, the model never acted on them across 105 attempts, which is the indirect attack Anthropic already trains against.

Anthropic traces the fault to its own prompt-injection training

Anthropic trains Claude to resist indirect prompt injection, where an attacker delivers instructions through tool results rather than through the user. Older models over-corrected and flagged unusual-looking user prompts as attacks, so the company taught Claude to weigh where in a conversation an instruction appears before flagging it.

"This significantly reduced false flags on user prompts, but we believe it generalized into blindly trusting the user input," Anthropic says. In the transcripts it analysed, Claude Opus 5.5 "often reasoned that anything in the user's message must come from the user and could not be a prompt injection, and therefore should be followed".

Some of the training data for resisting prompt injection was written by a model following a rubric that told it instructions in the user prompt should never be flagged, then handed to a model that never saw the rubric. The rule survived into Opus 5.5's reasoning, which cites it as if it were guidance the model had been given.

Claude Code now strips the characters you cannot see

Anthropic retrained the model and changed the apps around it, saying it is "adding product changes that remove invisible characters and mark pasted text to help Claude identify material that the user may not have written or checked".

Claude Code started removing invisible Unicode formatting and tag characters from prompts in version 2.1.275, showing the cleaned prompt for review before sending it. Version 2.1.280, the release that added Opus 5.5, fixed two faults in that cleanup: the prompt line stayed scrambled on Windows terminals once the characters were removed, and the cleanup was eating the zero-width non-joiner that Persian and Arabic use to attach a suffix to a Latin word. The screen is now repainted "so you review the exact text that will be sent".

Opus 5.5 arrived on September 22 at $4 per million input tokens, with most cybersecurity work re-routed to the older Opus 4.8 and a 66.4% Terminal-Bench score Anthropic ran itself.

Anthropic does not present the pasted-text problem as solved. "Whenever a user pastes text written by someone else into a prompt, they are effectively letting that person control part of their prompt," it says, and the most it asks of the model is that it reject the instructions virtually no user would want, such as one telling it to exfiltrate their SSH keys.