Data Report · RedactSure Research
Chris Sowa · Founder, RedactSure
Published
Last updated
How Many AI Agent Vendors Publish a Prompt Injection Rate?
Only 1 of 16 AI agent products reviewed publishes a prompt injection rate, so buyers of the other 15 have no number to plan against. Seven products from five leading vendors, including Anthropic, OpenAI and Meta, say in their own documentation that the risk remains.
One. Of 16 AI agent products reviewed, only Claude in Chrome comes with a published prompt injection rate, and Anthropic measured it on its own test sets. For the other 15, the launch posts, security pages, safety pages and documentation searched give a buyer no rate at all. What several vendors do say is that the risk remains: seven products from five leading vendors, including Anthropic, OpenAI and Meta, state in their own words that their safeguards reduce prompt injection risk without removing it. A buyer cannot set policy on a number the vendor does not publish, so the controls around an agent have to hold without knowing it.
Key findings
- Only 1 of 16 AI agent products reviewed publishes a prompt injection rate: Claude in Chrome, measured on Anthropic's own test sets (Anthropic, Mitigating, 2025).
- The other 15 publish no rate on the 2 to 4 launch, security, safety or documentation pages searched for each, so a buyer has no number to plan against (How Often Do AI Agents Follow Injected Instructions?).
- Seven AI agent products from five leading vendors, including Anthropic, OpenAI and Meta, state that prompt injection risk remains despite their safeguards (Anthropic, Security, n.d.).
- The Browser Company writes for Dia that its layered controls target the most harmful outcomes, "but no defense is perfect" (The Browser Company, n.d.).
- No vendor puts a rate beside its statement that risk remains, so even the vendors that admit the risk do not say how often it occurs (OpenAI, 2025).
Which agents publish an injection rate?
One of 16. Anthropic publishes attack success rates for Claude in Chrome from its own testing, and no other product in the set publishes a rate on the pages searched (Anthropic, Piloting, 2025). Seven of the 16 say in their own documentation that prompt injection risk remains.
| Product | Vendor | Publishes an injection rate | Says the risk remains |
|---|---|---|---|
| Claude in Chrome | Anthropic | Yes, from Anthropic's own tests | Yes, directly |
| Claude Code | Anthropic | Not on the pages searched | Yes, directly |
| Claude Computer Use | Anthropic | Not on the pages searched | Yes, indirectly |
| ChatGPT Atlas (discontinued August 2026) | OpenAI | Not on the pages searched | Yes, directly |
| Dia | The Browser Company | Not on the pages searched | Yes, directly |
| Meta Muse | Meta | Not on the pages searched | Yes, directly |
| Cursor browser agent | Cursor | Not on the pages searched | Yes, indirectly |
| Codex | OpenAI | Not on the pages searched | Not described in the pages searched |
| OpenAI Dots | OpenAI | Not on the pages searched | Not described in the pages searched |
| Gemini in Chrome | Not on the pages searched | Not described in the pages searched | |
| Grok Bot | xAI | Not on the pages searched | Not described in the pages searched |
| Comet | Perplexity | Not on the pages searched | Not described in the pages searched |
| Manus | Manus | Not on the pages searched | Not described in the pages searched |
| Opera Neon | Opera | Not on the pages searched | Not described in the pages searched |
| Devin | Cognition | Not on the pages searched | Not described in the pages searched |
| Browser Use | Browser Use | Not on the pages searched | Not described in the pages searched |
"Not on the pages searched" and "Not described in the pages searched" mean only that the vendor pages listed in the Sources did not include a rate or a statement. Two vendor pages could not be read because the sites refused automated access, so two products were judged on their launch posts alone.
The absence matters more than any single number. A security team approving an agent usually has to decide without a measured rate, and the research shows why that is a problem: agents with no defense followed injected instructions in 17.4% to 100% of tests, and attacks tuned to a defense got past most published defenses more than 90% of the time (How Often Do AI Agents Follow Injected Instructions?). Without a rate from the vendor, the safe assumption is that some injected instructions will be followed.
What do the vendors say about the risk that remains?
| Product | Vendor | What the vendor says | Type |
|---|---|---|---|
| Claude in Chrome | Anthropic | "No browser agent is immune to prompt injection" | Direct |
| Claude Code | Anthropic | Protections reduce risk, but "no system is completely immune to all attacks" | Direct |
| Claude Computer Use | Anthropic | Users "should take the relevant precautions to minimize these kinds of risks" | Indirect |
| ChatGPT Atlas | OpenAI | Prompt injection "makes deterministic security guarantees challenging" | Direct |
| Dia | The Browser Company | Layered controls target the worst outcomes, "but no defense is perfect" | Direct |
| Meta Muse | Meta | Muse "needs to act in adversarial environments," so Meta layers its defenses | Direct |
| Cursor browser agent | Cursor | "AI can behave unexpectedly due to prompt injection" | Indirect |
OpenAI made its statement about ChatGPT Atlas in December 2025 and discontinued Atlas in August 2026, so Atlas is not a current option (OpenAI, Introducing, 2025). The statement stays in the count because it describes the problem, not the product's future.
What does a vendor's admission tell a buyer?
It tells a buyer how the vendor expects its own defenses to perform: well, and not perfectly. That candor is useful. A vendor that says injection risk remains is telling the buyer to plan for the case where an instruction hidden in a web page, an email or a document gets followed. The measured record agrees. Across 16 studies and vendor reports, agents without a defense followed injected instructions in 17.4% to 100% of tests, and adaptive attacks got past most published defenses (How Often Do AI Agents Follow Injected Instructions?).
The practical question for a security team is therefore not whether the agent's model will resist every injection. It is what the agent can reach when one gets through: which sensitive values the model can read on the screen, and whether a named person approves each action that moves money, data or access.
Methodology and limitations
The 16 products are the AI agents covered most often on RedactSure's research pages: Claude in Chrome, Claude Code and Claude Computer Use (Anthropic); ChatGPT Atlas, Codex and OpenAI Dots (OpenAI); Gemini in Chrome (Google); Grok Bot (xAI); Meta Muse (Meta); the Cursor browser agent (Cursor); Dia (The Browser Company); Comet (Perplexity); Manus (Manus); Opera Neon (Opera); Devin (Cognition); and Browser Use (Browser Use). That is 16 products from 12 vendors. For each, the vendor's launch post and its security, safety or documentation pages were read on October 27, 2026, between two and four pages per product, and every page used was saved and is listed in the Sources. A statement counts when it is about the vendor's own agent and says that risk or harm remains despite safeguards. A statement is direct when it says the defense is imperfect and indirect when it concedes risk without saying so. Two pages refused automated access, xAI's safety page and OpenAI's release notes, so Grok Bot and OpenAI Dots rest on their launch posts alone.
A missing statement means only that none appeared on the pages searched. It does not mean the vendor claims its defenses are complete, and it is not a finding against that vendor. Some documentation is undated and was read as published on October 27, 2026. The counts describe this set of 16 products, not the market.
Frequently asked questions
Do AI agent vendors publish a prompt injection rate?
Rarely. Of 16 AI agent products reviewed, only Claude in Chrome publishes one, measured on Anthropic's own tests. Seven products, from Anthropic, OpenAI, The Browser Company, Meta and Cursor, say in their own documentation that risk remains, but none of those statements comes with a rate. For most agents, a buyer has no number to plan against.
Why would a vendor admit its defenses are imperfect?
Because the evidence leaves no other honest position. Published research shows agents following injected instructions in a large share of tests, and adaptive attacks bypassing most published defenses. A vendor that states the limit helps buyers plan for it, which is better for both sides than a guarantee that fails in production.
What should a security team do with these statements?
Treat them as the vendor's own design assumption and plan around it. Limit which sensitive values the agent's model can read on the screen, require a named person to approve consequential actions, and keep a record of what the agent saw and did. Those controls hold even when an injected instruction gets through.
How RedactSure Works From the Vendors' Own Assumption
The vendors say some injected instructions will get through. RedactSure starts from the same assumption and limits what such an instruction can reach.
The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company.
Before: an agent working a patient account reads the member ID and bank details on the screen, meets hidden text on a payer portal, and copies what it read into an outside form. Inside the governed environment: render-layer tokenization shows the model MEMBER_001 and ACCT_001 instead of the real values, so the injected instruction finds only tokens, and a named person approves every consequential action under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record.
RedactSure is deploying now with enterprise and government customers.
Everyone else controls where data can go. RedactSure controls what the AI can see.
See it on your own workflow
When the vendors say no defense is perfect, the design question is what an agent can reach on a bad day. Bring one task you would hand to an agent and see, with test values, what its model is shown and where a person approves the next step. Book a demo