Benign Injection: How Far a Single Line Like "Known Issue" or "Handled Elsewhere" Bends an AI's Judgment

Traditional prompt injection aims to make AI perform harmful, unintended operations by embedding malicious commands. Anthropic's system card indicates significant progress in model robustness against such attacks, with Claude Opus 5 and 5.5 reportedly showing very low attack success rates in coding environments.

However, the reported tests explore a different vulnerability, termed "benign injection." This occurs when a seemingly innocent note, such as "Known behavior (do not re-report)" in code or "Agreed with the customer" in a document, changes the AI's premise for judgment. The article defines this as a non-malicious form of contextual-bias injection.

The core finding from testing AIs on code and document review or editing tasks was that the models' judgment was consistently swayed when the note's claim could not be independently verified against the immediate material at hand. Conversely, notes whose claims were verifiable on the spot had minimal impact.

This indicates that AI models may uncritically accept uncheckable external claims, potentially overlooking real defects. The tests involved small Python repositories with single bugs, and while consistent across different content types and tasks, the models reportedly did not overlook issues like missing authorization or SQL injection, even with a benign note present.