AI Model Release Tracker
Prompt injection robustness

Gray Swan IPIk = 10

Attackers hide malicious instructions inside content the AI reads — a web page, an email, a document — and try to hijack what it does. This variant gives the attacker 10 tries and counts an attack as successful if any of them works. Lower is better.

k = 1k = 10k = 15

Rankings

Lower is better
#1
Claude Opus 5
1.6%
2
Claude Fable 5
2.3%
3
Claude Opus 4.8
4.1%
4
Claude Sonnet 5
4.7%
5
Muse Spark
14.3%
6
GPT-5.6 Sol
16.3%
7
GPT-5.5
17.4%
8
GPT-5.6 Terra
26%
9
Gemini 3.6 Flash
32.2%
10
GPT-5.6 Luna
38.6%
11
Gemini 3.1 Pro
45.7%
12
Gemini 3.5 Flash
54.2%
12
Grok 4.5
54.2%

Gray Swan IPI — frequently asked questions

Attackers hide malicious instructions inside content the AI reads — a web page, an email, a document — and try to hijack what it does. This variant gives the attacker 10 tries and counts an attack as successful if any of them works. Lower is better.