Stacked Defense Layers Drop Prompt Injection to 0 in Claude Code

Anthropic is claiming that stacked defense layers can drop prompt injection attacks to zero, even against unseen attacks. Boris Cherny, in a discussion about Claude Code's new Auto Mode, outlined the layered approach: model training, intent classifier, and input probes. He also confirmed the classifier is now free, responding to token cost concerns with: "We are making the classifier free. You should not need to pay for safety."

How the Layers Stack Up

• Model training: The base model is fine-tuned to recognize and reject injection patterns.
• Intent classifier: A separate classifier checks the user's intent behind each prompt, filtering out malicious requests before execution.
• Input probes: Active probes test inputs for known injection vectors, adding another barrier.

According to the source, this combination reduces prompt injection rates to 0% on unseen attacks. The key is that no single layer is perfect, but stacked they catch the vast majority of attempts.

Classifer Now Free

Boris Cherny's quote is direct: "We are making the classifier free. You should not need to pay for safety." This addresses a common pain point—token cost—for developers who worried that adding safety checks would drain their budgets. If you've been bypassing safety features to save tokens, that's no longer a concern.

This is particularly relevant for teams building autonomous agents with Claude Code, where prompt injection is a real risk—malicious prompts in web content or tool outputs could hijack the agent. With the classifier free, you can enable it without worrying about extra fees.

The full blog post is about Auto Mode in Claude Code, but this security detail stands out. For developers, it's a signal that Anthropic is treating safety as a baseline feature, not a premium add-on.