Claude Code Father: 720 Attempts of Code Injection Attack 0 Successful, Couldn't Even Dream of It a Year Ago

According to Watchful Beating monitoring, Claude Code lead Boris Cherny stated that Anthropic has "essentially solved" the word prompt injection attack in practical use. A year ago, he himself didn't think it could be done to this extent.

Word prompt injection attacks have always been a headache for Agents. A malicious webpage can hide a command that tricks the Agent into stealing passwords, uploading keys, or even performing actions that the user never intended.

Anthropic now relies on three layers of defense: Claude itself first resists malicious commands, external content is checked again before entering the context, and before actually executing operations, Auto Mode performs another review.

In a third-party test, 72 previously unseen attacks were attempted, repeated 720 times. With Sonnet 5, Fable 5, and Opus 5 in Auto Mode, none were successful.

In the same test, GPT-5.6 Sol using Codex Auto-review had a success rate of 5.83%, while Full Access reached 19.03%.

This also explains why Anthropic dares to set Auto Mode as the default. It is the final check in Claude Code's defense against word prompt injection attacks.