Type: url
Original: https://www.anthropic.com/research/prompt-injection-defenses
Status: generated
Summary
Anthropic’s account of prompt injection risk in browser use and the defences built against it. It argues browser agents amplify the risk two ways — a vast attack surface across every page, document, advertisement and dynamically loaded script, and a wide action space of navigating, form-filling, clicking and downloading — and describes three layers of response: reinforcement learning against injections embedded in simulated web content, classifiers scanning all untrusted content entering the context window for hidden text, manipulated images and deceptive UI elements, and continuous internal plus external red teaming. It reports a 1% attack success rate against an internal adaptive Best-of-N attacker given 100 attempts per environment, and states plainly that this still represents meaningful risk and that no browser agent is immune.