Skip to content

Gray Swan Indirect Prompt Injection, attack success at 15 attempts

Measures how often indirect prompt-injection attacks succeed within fifteen attempts. Lower scores mean greater resistance to the tested attacks.

12 models

Lower is better on this benchmark.

  1. 1Gemini 4 ArgonGoogle0.7
  2. 2Claude Opus 5.5Anthropic1.0
  3. 3Claude Fable 5.1Anthropic1.0
  4. 4Claude Opus 5Anthropic4.6
  5. 5Gemini 3.8 FlashGoogle5.5
  6. 6GPT-6 AstraOpenAI8.5
  7. 7GPT-6 SolOpenAI10.1
  8. 8Muse Spark 1.3Meta15.9
  9. 9GPT-5.6 SolOpenAI27.0
  10. 10GLM-5.3Z.AI31.5
  11. 11Grok 4.6xAI51.8
  12. 12Kimi K3Moonshot AI52.7
Lower is better. Bar colour: blue proprietary, orange open weights, green other.

About this benchmark

Metric
Attack success rate at 15 attempts
Tasks
Indirect prompt-injection attacks
Authors
Gray Swan (2026)

Scores are as reported by model developers or evaluators and may use different settings (for example reasoning effort or tools). Compare with care.