Anthropic saw Opus 5.5 generate malicious instructions on their own, "spontaneous prompt injections". from Claude Opus 5.5 system card. Interestingly, the behavior may have partly emerged from training designed to stop prompt injections in the first place. " we roughly characterize these malicious commands as model-generated spontaneous prompt injections, and we believe they are, in part, a result of training intended to defend against prompt injection."