ACVE-2026-0201 · Hijack shown in a test · HIGH

Unverified · secondary sources only

WHAT HAPPENED

The agent calls a side-effecting tool with the arguments the injected text supplied, for example sending the user's security code or a transfer to the attacker.

THE SETUP — is yours like this?

Harness: Any harness that gives one agent a tool that reads untrusted content and a side-effecting tool (the affected list names claude-code, codex-cli, cursor, gemini-cli, copilot-cli, vscode-copilot-chat and claude-desktop) · Claude Code: all versions; Codex CLI: all versions; Cursor: all versions; Gemini CLI: all versions; Copilot CLI: all versions; VS Code Copilot Chat: all versions; Claude Desktop: all versions, arxiv.org
Model: any model, arxiv.org
Goal: not stated (unconfirmed)
Tools: A tool that returns untrusted content (email, web page, issue or MCP tool result) and a side-effecting tool (shell, file write or MCP write); AgentDojo simulates 70 such tools across its workspace, Slack, travel and banking suites, arxiv.org
Approval: Side-effecting tools run with no confirmation or under a broad allowlist; the benchmarks execute every tool call the model emits, arxiv.org

WHAT TO CHANGE

Require approval for side-effecting tools, or separate or filter the tools.

Reconfigure agent.approval to ask. A person decides before untrusted content can cause a side effect. Owner: operator
Reconfigure harness.tools to only the tools the task needs, chosen before untrusted content is read. Recommended: AgentDojo's tool_filter cut GPT-4o's targeted ASR from 47.69% to 6.84%. Owner: harness-vendor
Reconfigure model.toolResults to instructions inside tool results treated as data. Recommended: the benchmarks show the injection rate moves with the model. Owner: model-provider

HARM, REACH AND RECOVERY

Harm: harmful-action
Reach: Whatever the side-effecting tools can act on (detected), arxiv.org (the network)
Condition: When a tool returns content an outsider wrote and side-effecting tools run without confirmation, arxiv.org
Evidence and responses: Demonstrated · researcher report

SOURCES

ARTICLE

EVIDENCE

https://agentdojo.spylab.ai/results/

Technical details

An agent on any harness and any model, with side-effecting tools auto-approved or allowlisted, reads untrusted content that carries instructions and makes the tool call the content asked for.

Model as recorded: any

Severity: HIGH · evaluation ASR (ASR 48%)
Status: Unverified
Kind: Hijack shown in a test
Modified: 2026-09-25
Aliases: No CVE assigned — configuration pattern; no code defect in any one product
CVE boundary: combination
Affected: AgentHarness: claude-code — all versions
AgentHarness: codex-cli — all versions
AgentHarness: cursor — all versions
AgentHarness: gemini-cli — all versions
AgentHarness: copilot-cli — all versions
AgentHarness: vscode-copilot-chat — all versions
AgentHarness: claude-desktop — all versions
Harness/product: claude-code + codex-cli + cursor + gemini-cli + copilot-cli + vscode-copilot-chat + claude-desktop
Classes: prompt-injection-to-tool; over-privileged-combination; CWE-1427
Taxonomy: LLM: LLM01; ASI: ASI01; ASI: ASI02; ATLAS: AML.T0051.001; ATLAS: AML.T0053
First reported: 2024-06-19 — AgentDojo (arXiv)
Input controlled by: content-author
Divergence: instruction-followed
Goal as recorded: Any task that reads untrusted content with side-effecting tools available (goal not stated by the source)
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference))

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

content-author · prompt-injection · harmful-action

What

Text returned by a web page, email, issue or MCP tool can carry instructions the model follows (indirect prompt injection). AgentDojo, InjecAgent, WASP and ASB measure how often it works; the rate moves with model, attack, defence and attempt count (see reference/model-injection-benchmarks.json). A successful injection runs any auto-approved tool with the user's authority.

Detection

The lockfile sees an untrusted-input tool, a side-effecting tool and the approval mode; it cannot see what content the agent reads or what task it was given.

Fix

Require approval for side-effecting calls, keep reading and acting in separate agents, or restrict the tool set per task: on the AgentDojo leaderboard tool_filter took GPT-4o from 47.69% to 6.84% targeted ASR.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  some tools where
    untrustedInput eq true
  some tools where
    sideEffect eq true
  approval in ["never","allowlist"]

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
AgentDojo leaderboard	targeted-asr	0.4769	—	none	gpt-4o-2024-05-13	https://agentdojo.spylab.ai/results/
AgentDojo leaderboard	targeted-asr	0.0684	—	tool_filter	gpt-4o-2024-05-13	https://agentdojo.spylab.ai/results/

Reference: model injection benchmarks

Report a problem JSON