Most AI security writing stops at the threat. Your agent reads untrusted content, an attacker hides instructions in it, bad things happen. Fine. The question our clients actually ask is narrower: when we deploy Claude, what is it doing about that, and what does that buy us?
Anthropic has shipped real safeguards against prompt injection and memory poisoning. They are worth taking seriously. They are also worth reading carefully, because some of the strongest numbers come with conditions attached, and Anthropic’s own engineers will tell you the same thing.
The defenses that meet untrusted content
When a Claude agent reaches out to the internet, the content that comes back is untrusted. Anthropic layers several controls at that boundary:
- Classifier scanning of untrusted content. Untrusted content entering the model’s context gets scanned by classifiers that flag injected instructions, including hidden text and deceptive page elements. Anthropic’s browser-use writeup describes classifiers that detect adversarial commands embedded in web content and adjust model behavior when they fire.
- Reinforcement learning against injection. During training, Claude is exposed to injections hidden in simulated web content and rewarded for identifying and refusing them, even when they read as urgent or authoritative. This is a model-level defense: the model itself has been trained to resist.
- Tool-output proxies in Claude Code and Cowork. Tool calls route through proxies that enforce network and file policy and can inspect return values before they enter the model’s context. Anthropic’s engineering team notes the inspector can be a small, fast model rather than the one doing the reasoning.
The headline numbers here are genuinely strong. On Gray Swan’s agent red teaming benchmark, Claude Opus 4.7 holds prompt injection attack success to about 0.1% on a single attempt. That is real progress against a class of attack that defeated everything for years.
Where the numbers get honest
The same Anthropic writeup attaches conditions to that 0.1%, and the conditions matter more than the number.
Adaptive attackers change the picture. Against an adaptive attacker who tries 100 different variations, the same model’s failure rate climbs to around 5 to 6 percent. If you run an agent long enough against hostile content, someone will eventually try 100 variations. Single-attempt benchmarks flatter every model.
Surface matters more than model. Anthropic’s own system card for Claude Opus 4.6 reports 0% attack success for a constrained coding environment across 200 attempts. On a GUI-based surface with extended thinking enabled, single attempts got through 17.8% of the time without safeguards, and after 200 attempts the breach rate hit 78.6% without safeguards and 57.1% with them. Same model family, different surface, different decade of risk. The constrained environment is doing most of the work, not the model.
Direct injection still slips through. In an internal Anthropic red-team exercise, a phished employee pasted a malicious prompt that asked Claude to read ~/.aws/credentials and POST the contents to an external endpoint. It succeeded 24 out of 25 retries. When instructions arrive through the user’s own hands, there is nothing anomalous for a classifier to catch. Anthropic’s conclusion: only environment controls, egress blocks and filesystem boundaries, hold in that scenario. The model layer cannot.
The deterministic layer: sandboxing, permissions, egress
That conclusion drives Claude Code’s design. The model layer is probabilistic and will sometimes miss. The deterministic layer is not, and it has to be switched on: sandboxing is opt-in, not a factory default. In Claude Code:
- OS-level sandboxing restricts what Bash commands can touch. On macOS that’s Seatbelt, on Linux bubblewrap. The OS enforces the boundary on the running process regardless of what the model chose to run, even if an allowed command does more than its name suggests.
- Filesystem isolation keeps writes inside the working directory and session temp by default. A fetched web page cannot direct Claude into writing to your shell config or system binaries.
- Network isolation with per-domain approval. The first time a command needs a new domain, Claude Code prompts for approval. Allowlists can pre-approve domains; a strict allowlist mode denies anything not on the list. WebFetch is additionally checked against Anthropic’s blocklist preflight before fetching.
- Permission modes and hooks. Allow/ask/deny rules per tool and domain, permission modes that control prompting, and PreToolUse hooks that let your own scripts evaluate or block every tool call.
The point of the layering is containment: assume the model will eventually obey an injection, then make obedience useless. An exfiltration POST to an unknown host is blocked at the proxy whether or not the model was fooled. One caveat from Anthropic’s own incident log: a destination on an approved domain list sails through, which is exactly how their Cowork exfiltration happened: data left through a permitted path. The allowlist is part of the boundary, not an afterthought. That is what “environment over model” means in practice.
Memory poisoning, and what changed
Memory poisoning is the persistence problem. An attacker gets text into something your agent reads back as trusted context, a CLAUDE.md file, a project knowledge file, and every future session inherits the payload. It is worse than a one-shot injection because the payload survives the session.
The documented Claude Code cases share a shape: memory content was treated as high-authority instruction. Cisco’s AI security team showed a malicious npm package writing instructions into Claude Code’s persistent memory, where it loaded as part of the system prompt and survived across sessions and projects. The fix in v2.1.50 stopped loading user memories into the system prompt. That’s a real fix for that specific vector, not a proof that memory is now safe.
The University of Washington’s Bad Memory study (arXiv 2607.14611) measured the remaining surface: the plain-text memory files agents are told to read and maintain. Two findings should shape how you deploy any agent. A payload already sitting in a memory file can steer the current session and often re-fires in later sessions. And there is no platform patch for user-curated files, because the agent is supposed to be able to write them. The paper’s own recommendations are design-level: permission boundaries on memory updates, stricter validation when each session starts, and separating memory into trust tiers. Our deployment take on top of that is operational: put memory files in version control and review what your agents remember.
What we tell clients
Anthropic is doing more than anyone to make agent safety measurable, and their honesty about residual risk is part of why we take the numbers seriously. But their own guidance says the quiet part out loud: model-layer protection will never be 100% effective, so it cannot stand alone.
If you’re deploying Claude, or any agent, treat it as three layers to configure, not one product to trust:
- Match the surface to the risk. Constrained, text-based coding environments showed the strongest injection resistance in Anthropic’s own data. GUI agents and anything browsing hostile content carry materially higher risk. Deploy accordingly.
- Configure the environment like it matters, because it’s the layer that never gets fooled. Sandbox on, filesystem boundaries on, network allowlist tight, egress to unknown hosts denied unless explicitly allowed, hooks if you have policy to enforce. The exfiltration is blocked at the proxy whether or not the model was fooled.
- Treat agent memory files like production config. They are writable, they load as trusted context, and no vendor patch covers the files your agent maintains. Put them in version control, review changes to them like code review, and audit them when an agent behaves strangely.
The safeguards are real. So is Anthropic’s own conclusion that they are necessary but not sufficient. If you’re deploying agents against untrusted content and want the environment layer configured with that in mind, that’s the work we do.