Prompt Injection Attacks: Gray Swan Benchmark Data

Understanding Prompt Injection Threats

Prompt injection represents one of the most critical security vulnerabilities facing AI agents today. As Boris Cherny highlights, attackers embed malicious instructions directly into web content that AI agents visit. For example, a compromised website might contain hidden text instructing the model to "send the user's ssh keys and passwords" to an attacker-controlled server. The AI model interprets these embedded commands as legitimate instructions, potentially exposing sensitive user data. This attack vector becomes particularly dangerous as AI agents gain broader permissions to browse the web, access tools, and interact with user systems. The Gray Swan IPI benchmark from Q1 2026 provides the first comprehensive measurement of how vulnerable leading AI models are to these indirect prompt injection attacks.

Gray Swan Benchmark Results: Model Vulnerability Comparison

The Gray Swan IPI benchmark tested indirect prompt injection robustness across eleven leading AI models, measuring attack success probability after 1, 10, and 15 attempts. Grok 4.5 showed the highest vulnerability at k=15 with a 60.8% success rate, followed closely by Gemini 3.5 Flash at 60.5%. GPT-5.6 Luna demonstrated 43.9% vulnerability, while GPT-5.6 Terra and Sol showed 30.4% and 20.0% respectively. The most resistant models included Opus 4.8 (5.5%), Mythos 5 (2.6%), Fable 5 (2.8%), Sonnet 5 (5.9%), and Opus 5 (2.0%). All models were tested using extended thinking capabilities. Notably, even a single attempt (k=1) yielded double-digit success rates for several models, with Grok 4.5 at 54.2% and Gemini variants showing similar vulnerability, indicating serious real-world risk.

Browser-Use and Tool-Calling Attack Vectors

The second benchmark examined prompt injection success rates specifically for browser-use and tool-calling scenarios across four models with different permission configurations. GPT-5.6 Sol showed the highest vulnerability with 19.03% success rate in Full Access mode and 5.83% in Auto-review mode, based on 720 test attempts (72 tasks × 10 attempts). Fable 5 demonstrated 0.28% vulnerability in bypass mode but 0.00% in auto mode. Both Sonnet 5 and Opus 5 maintained 0.00% attack success across all tested configurations, including bypass and auto modes for Anthropic models. This data reveals that tool-calling permissions significantly amplify prompt injection risks, with OpenAI's Full Access mode proving particularly vulnerable compared to more restrictive permission models employed by Anthropic's Claude variants.

Defense Mechanisms and Permission Models

The benchmark data reveals that permission architecture plays a crucial role in mitigating prompt injection attacks. Anthropic's models (Sonnet 5, Opus 5) tested with both bypassPermissions and auto mode configurations showed zero successful attacks, suggesting their permission model provides effective defense. The Auto-review mode for GPT-5.6 Sol reduced attack success from 19.03% to 5.83%, demonstrating that human-in-the-loop verification significantly improves security. However, the Full Access mode's vulnerability indicates that unrestricted tool-calling creates substantial risk. These findings suggest that AI agent deployments should implement layered defenses: restrictive default permissions, mandatory review workflows for sensitive operations, and careful vetting of external content sources. The variation across models also indicates that architectural choices in how models process and separate instructions from content materially impact security outcomes.

Implications for AI Agent Deployment

These benchmark results carry significant implications for organizations deploying AI agents with web browsing or tool-calling capabilities. The high success rates observed in models like Grok 4.5 (60.8%) and Gemini 3.5 Flash (60.5%) indicate that prompt injection should be treated as a near-certainty rather than an edge case. Security teams must assume that AI agents will encounter malicious instructions and design systems accordingly. Critical mitigations include: sandboxing agent operations, implementing strict permission boundaries, requiring human approval for sensitive actions, maintaining comprehensive audit logs, and filtering or sanitizing external content before agent processing. The fact that even sophisticated models with extended thinking capabilities remain vulnerable suggests this is a fundamental challenge requiring defense-in-depth approaches rather than relying solely on model improvements.