Anthropic browser agent hijacked 31.5%

1/ Anthropic’s newly disclosed 31.5% browser-agent hijack rate is a useful data point, but only in context: it was measured before safeguards engaged and during interactions with web-originated content, according to VentureBeat’s report on June 2. Anthropic has separately said browser use creates a large prompt-injection surface because every webpage, document, ad and script can carry hostile instructions. (venturebeat.com) 2/ The number matters because browser agents do more than answer questions. Anthropic says browser agents can navigate to URLs, fill forms, click buttons and download files, which means a successful prompt injection can push an agent from “reading untrusted content” into taking actions on a user’s behalf. (anthropic.com) 3/ Anthropic’s own framing is that prompt injection is “far from a solved problem,” even after improvements. In its November 2025 browser-safety writeup, the company said no browser agent is immune and that even a 1% attack success rate would still represent meaningful risk. (anthropic.com) 4/ That is why the 31.5% figure should not be read as a simple apples-to-apples score against other vendors. VentureBeat reported that Anthropic, OpenAI, Google and Meta have published prompt-injection disclosures in 2026, but not with matching definitions, test conditions or surfaces, making direct comparison difficult. (venturebeat.com) 5/ In practical terms, one vendor may report model-only resistance, another may report a guarded product flow, and another may focus on a narrower surface such as connectors. When those scopes differ, a single percentage can look more precise than it really is. That is an inference from the mismatch VentureBeat described and from Anthropic’s own distinction between model robustness and surrounding safeguards. (venturebeat.com) 6/ Anthropic released Claude Opus 4.8 on May 28 and said the model improved performance on coding, agentic tasks and browser-agent benchmarks. The same launch pointed readers to a dedicated Opus 4.8 system card for broader capability and safety details. (anthropic.com) 7/ The security lesson for enterprise teams is narrower than “Anthropic is weak” or “Anthropic is transparent.” The safer reading is that browser-agent risk depends on at least two layers: how often hostile content can steer the model, and what external controls stop that steering from turning into sensitive actions. Anthropic’s research page explicitly separates core model performance from safeguards around browser use. (anthropic.com) 8/ That also means procurement teams should ask vendors for the missing details behind any hijack number: Was it measured before or after safeguards? Against what attacker? On which surfaces? With what tools enabled? Anthropic says its browser evaluations used an internal adaptive “Best-of-N” attacker combining known prompt-injection techniques. (anthropic.com) 9/ Another point: browser use is only one agent surface. Anthropic’s documentation hub lists system cards as the place where model capabilities, safety evaluations and deployment safeguards are documented, which suggests security buyers need those underlying materials, not just launch-blog claims or benchmark snippets. (anthropic.com) 10/ Until vendors converge on standard, enterprise-relevant prompt-injection metrics, the most defensible use of numbers like 31.5% is comparative within a single vendor’s own methodology over time, not as a clean leaderboard across the industry. The current disclosures are better than silence, but they are still not standardized measurement. (venturebeat.com)