{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0201",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Llama 3.3 70B reaches 53.8% InjecAgent ASR with untrusted tool content and no defence.",
  "details": "## What the vulnerability is\n\nLlama 3.3 70B Instruct is not uniformly resistant to indirect prompt injection. In the SecAlign paper table, AgentDojo reports 14.7% targeted ASR and InjecAgent reports 53.8% ASR with no defence. WASP, which drives real Dockerised GitLab and Reddit applications, reports 20.2% intermediate ASR but 2.4% end-to-end ASR. Gray Swan ART 2025 reports 6.49% per-attempt ASR, the worst of its 22 models. The AgentDojo and InjecAgent tools are simulated; WASP is the important real-browser comparison.\n\n## Which configuration is exposed\n\nThe exposed shape is this family served at an unpinned HF or Ollama tag inside an agent that ingests email, web, repository, or MCP-returned text. At least one such tool has untrustedInput=true, at least one has sideEffect=true, and approval is auto, bypassPermissions, yolo, or trusted. A reader can recognise it as Ollama-served llama3.3 behind Open WebUI or Continue with shell or file tools and no approval prompt. Egress makes the same path useful for secrets, even when the immediate tool is only a file writer.\n\n## How ACVE detects it\n\nThe matcher accepts the model family on model.id or in models[], then requires separate tool witnesses for untrustedInput and sideEffect, followed by approval in never or allowlist. A pinned digest and visible tool inventory can make a match confirmed; a floating model tag makes the model predicate possible, and a model server whose tools are unknown keeps the tool predicate possible. The lock records safeguards only when discovery writes them into safeguards, so a server-side classifier or planner is invisible otherwise.\n\n## Fix\n\n1. Change side-effecting calls to agent.approval=ask and keep the human decision at the call boundary. 2. Put LlamaFirewall Prompt Guard 2 and AlignmentCheck on the tool-result path, not only on the user prompt. 3. Where that defence cannot be deployed, move the agent to facebook/Meta-SecAlign-70B; its AgentDojo result is 1.9% versus Llama 3.3 at 14.7%. Rebuild the lock after recording the model revision and safeguards.\n\n## Grounding needed\n\nA reproduction should pin the Llama 3.3 70B bf16 identity or exact quantised digest, the AgentDojo, InjecAgent, and WASP commits, released attack strings, seeds, tool inventory, auto-approval state, and classifier state. R7 marks the core paper numbers H because they are verified primary results, while ART is also primary but reports a competition per-attempt rate. Do not turn the simulated-tool results into a claim about real command execution without an in-harness reproduction.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "llama-3.3"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Model",
        "name": "llama-3.2"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2507.02735"
    },
    {
      "type": "EVIDENCE",
      "url": "https://www.grayswan.ai/blog/uk-aisi-x-gray-swan-agent-red-teaming-challenge-results-snapshot"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.147,
          "model": {
            "id": "Llama-3.3-70B-Instruct",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://agentdojo.spylab.ai/results/",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.538,
          "model": {
            "id": "Llama-3.3-70B-Instruct",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "17 user tools",
              "62 attacker tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "WASP",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.202,
          "model": {
            "id": "Llama-3.3-70B-Instruct",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "real GitLab web app",
              "real Reddit web app"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "real tools; intermediate ASR"
        },
        {
          "kind": "eval",
          "benchmark": "WASP",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.024,
          "model": {
            "id": "Llama-3.3-70B-Instruct",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "real GitLab web app",
              "real Reddit web app"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "real tools; end-to-end ASR"
        },
        {
          "kind": "eval",
          "benchmark": "Gray Swan ART",
          "benchmarkVersion": "2025",
          "attack": "direct and indirect injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.0649,
          "model": {
            "id": "Llama 3.3 70B",
            "quant": null
          },
          "setup": {
            "tools": [
              "competition agent tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://www.grayswan.ai/blog/uk-aisi-x-gray-swan-agent-red-teaming-challenge-results-snapshot",
          "note": "competition per-attempt"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.019,
          "model": {
            "id": "Meta-SecAlign-70B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; SecAlign++ defence"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent comparison",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.005,
          "model": {
            "id": "Meta-SecAlign-70B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; SecAlign++ defence"
        },
        {
          "kind": "eval",
          "benchmark": "WASP comparison",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.012,
          "model": {
            "id": "Meta-SecAlign-70B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "real web apps"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; intermediate ASR"
        },
        {
          "kind": "eval",
          "benchmark": "WASP comparison",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0,
          "model": {
            "id": "Meta-SecAlign-70B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "real web apps"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; end-to-end ASR"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "llama-3.3",
                      "llama-3.2"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "llama-3.3",
                    "llama-3.2"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Require approval and add tool-output defences for Llama 3.3 agents.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Keep a human decision before untrusted content can trigger a side effect."
          },
          {
            "type": "reconfigure",
            "target": "defence:Prompt Guard 2+AlignmentCheck",
            "to": "on",
            "why": "LlamaFirewall reduces the cited AgentDojo path from 17.6% to 1.75% when both layers are enabled."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "facebook/Meta-SecAlign-70B",
            "why": "The cited AgentDojo comparison is 1.9% for Meta-SecAlign-70B versus 14.7% for Llama 3.3."
          }
        ]
      }
    }
  }
}