{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0202",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Llama 3 70B reaches 25.60% targeted AgentDojo ASR without a tool defence.",
  "details": "## What the vulnerability is\n\nThe Llama 3 70B Chat configuration has a 25.60% targeted ASR on AgentDojo important_instructions with no defence. R7 identifies the model as meta-llama/Llama-3-70b-chat-hf served through Together, with quantisation unknown. The benchmark uses four simulated, stateful suites whose tools can alter the environment; it is not a claim that every Llama 3 response is unsafe. The useful comparison is Llama 3.3 70B at 14.7% on the same family of AgentDojo-style measurement and GPT-5 at 0.2% in the SecAlign table.\n\n## Which configuration is exposed\n\nA tool-calling agent is exposed when this Llama 3 70B family reads attacker-controlled email, documents, web pages, repository content, or MCP results and can then call a side-effecting tool without a human approval step. In practical terms, that is a hosted Llama 3 70B endpoint wired to a shell, ticketing, filesystem, or browser action with auto approval. The rule is about the conjunction, not the model name alone; a text-only chat deployment does not satisfy the tool condition.\n\n## How ACVE detects it\n\nACVE first matches model.family llama-3 through model.id or a reachable models[] entry. It then requires both an untrustedInput tool and a sideEffect tool and checks approval for never or allowlist. A resolved model id and enumerated tools support a confirmed result. An undated or floating service alias, or an agent server that does not disclose tools, is deliberately only possible. Runtime prompt filters, planner isolation, and vendor safeguards count only if discovery records them under safeguards; the lock cannot infer them from the endpoint.\n\n## Fix\n\n1. Set agent.approval to ask before every side-effecting call. 2. Turn on tool_filter or equivalent plan-then-execute isolation so untrusted tool output cannot directly select a write or execution operation. 3. If a model change is feasible, use Llama 3.3 70B Instruct and measure it again; its 14.7% AgentDojo result is lower than 25.60%, and a later defence must still be recorded. Pin the chosen model rather than relying on a moving family tag.\n\n## Grounding needed\n\nThe reproduction must identify the exact Llama 3 70B revision, provider and quantisation, AgentDojo commit and important_instructions attack, all four suites, attack strings, seeds, auto-approval setting, and any tool filter. R7 gives H confidence: the 25.60% result is a verified primary leaderboard value, but its quantisation is unknown. The comparison values are not a substitute for a paired run, and the simulated environment should be named in any report.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "llama-3"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://agentdojo.spylab.ai/results/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.256,
          "model": {
            "id": "meta-llama/Llama-3-70b-chat-hf",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://agentdojo.spylab.ai/results/",
          "note": "quant unknown; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.147,
          "model": {
            "id": "Llama-3.3-70B-Instruct",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.002,
          "model": {
            "id": "GPT-5",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "llama-3"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "llama-3"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Require approval, filter tool output, or move off Llama 3 70B.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Prevent the 25.60% AgentDojo path from directly authorising a side effect."
          },
          {
            "type": "reconfigure",
            "target": "defence:tool_filter",
            "to": "on",
            "why": "AgentDojo reports 6.84% for GPT-4o with tool_filter versus 47.69% without it, establishing the relevant defence pattern."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "meta-llama/Llama-3.3-70B-Instruct",
            "why": "The cited AgentDojo comparison is 14.7%, below Llama 3 70B at 25.60%."
          }
        ]
      }
    }
  }
}