AI Model Release Tracker
Prompt injection robustness

Gray Swan IPIk = 1

Attackers hide malicious instructions inside content the AI reads — a web page, an email, a document — and try to hijack what it does. Gray Swan's indirect prompt injection benchmark measures how often such an attack succeeds when the attacker gets a single try. Lower is better.

k = 1k = 10k = 15

Rankings

Lower is better
#1
Claude Opus 5
0.2%
2
Claude Fable 5
0.4%
3
Claude Opus 4.8
0.5%
4
Claude Sonnet 5
0.6%
5
Muse Spark
2.9%
6
GPT-5.5
3%
7
GPT-5.6 Sol
3.1%
8
GPT-5.6 Terra
5.4%
9
Gemini 3.6 Flash
7.3%
10
GPT-5.6 Luna
8.3%
11
Grok 4.5
13.4%
12
Gemini 3.5 Flash
14.1%
13
Gemini 3.1 Pro
14.2%

Gray Swan IPI — frequently asked questions

Attackers hide malicious instructions inside content the AI reads — a web page, an email, a document — and try to hijack what it does. Gray Swan's indirect prompt injection benchmark measures how often such an attack succeeds when the attacker gets a single try. Lower is better.