“In a security competition offering a $20,000 prize, external researchers were able to prompt inject every participating model except for Anthropic's model within Claude Code.”