ACVE-2026-0203 · Hijack shown in a test · MODERATE

Unverified · secondary sources only

WHAT HAPPENED

The agent treats the forged system or user turn inside the tool result as an instruction and calls the tool the injection asked for.

THE SETUP — is yours like this?

Harness: Any harness that inserts tool output into the model's chat template unescaped; the paper ran the AgentDojo and InjecAgent harnesses against the models through OpenRouter at temperature 0, arxiv.org
Model: Qwen3-235B-A22B, GPT-oss-120b, GLM-4.5, Llama-4-Maverick and Kimi-K2 (the paper also tests GPT-4o, Grok-2, Grok-3, Gemini-2.5-Pro and Gemma-3), arxiv.org
Goal: An AgentDojo user task in the banking, Slack or travel-booking suite, or an InjecAgent user task, whose tool results the attacker can write into, arxiv.org
Tools: Simulated AgentDojo and InjecAgent tools whose results are inserted into the model's chat template unescaped; the model's public chat-template role tokens, arxiv.org
Approval: The benchmark harnesses execute every tool call the model emits; the paper describes no confirmation step, arxiv.org

WHAT TO CHANGE

Require approval for side effects; escape role tokens in tool output, which the paper shows is not sufficient by itself.

Reconfigure agent.approval to ask. Format filtering is bypassable, so the approval boundary is the control that holds. Owner: operator
Reconfigure harness.toolOutput to chat-template role tokens escaped before tool output enters the template. Recommended: the attack forges system and user turns with role tokens; the paper finds filtering alone insufficient. Owner: harness-vendor

HARM, REACH AND RECOVERY

Harm: harmful-action
Reach: The simulated tools of the benchmark environments, arxiv.org (the network)
Condition: When tool output is inserted into the chat template without escaping role tokens, arxiv.org
Evidence and responses: Demonstrated · researcher report

SOURCES

ARTICLE

https://arxiv.org/abs/2509.22830

EVIDENCE

https://arxiv.org/html/2509.22830

Technical details

A tool-result injection in the model's own chat-template role tokens is obeyed as a system or user turn by auto-approved agents on Qwen3-235B-A22B, GPT-oss-120b, GLM-4.5, Llama-4-Maverick or Kimi-K2.

Severity: MODERATE · evaluation ASR (ASR 79%)
Status: Unverified
Kind: Hijack shown in a test
Modified: 2026-09-25
Aliases: No CVE assigned — attack technique against model chat templates; no code defect in one product
CVE boundary: behavioural
Affected: Model: llama-4 — all versions
Model: qwen3 — all versions
Model: glm-4.5 — all versions
Model: gpt-oss-120b — all versions
Model: kimi-k2 — all versions
Harness/product: llama-4 + qwen3 + glm-4.5 + gpt-oss-120b + kimi-k2
Classes: prompt-injection-to-tool; CWE-1427
Taxonomy: LLM: LLM01; ASI: ASI01; ASI: ASI02; ATLAS: AML.T0051.001; ATLAS: AML.T0065
First reported: 2025-09-26 — ChatInject (arXiv)
Input controlled by: content-author
Divergence: instruction-followed
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference))

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

content-author · prompt-injection · harmful-action

What

ChatInject (arXiv:2509.22830) wraps an injection in the target model's chat-template role tokens, so text inside a tool result reads as a higher-priority turn. Table 1: AgentDojo ASR rose from 17.5% to 54.8% on Qwen3-235B-A22B, 0.3% to 51.4% on GPT-oss-120b, 0.3% to 20.3% on GLM-4.5 and 1.0% to 17.2% on Llama-4-Maverick; the multi-turn variant reached 80.5% on Qwen3. Tools are simulated. It amplifies injection but needs the ACVE-2026-0201 exposure to cause harm.

Detection

The lockfile sees the model family, the tool attributes and the approval mode; it cannot see whether tool output is escaped before it enters the template.

Fix

Require approval for side effects. Escaping role tokens in tool output helps, but the paper warns "deterministic format filters alone are insufficient": with 10% of template characters perturbed the attack still beat the plain-text baseline.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  or
    and
      model.id exists
      model.family in ["llama-4","qwen3","glm-4.5","gpt-oss","gpt-oss-120b","kimi-k2"]
    some models where
      family in ["llama-4","qwen3","glm-4.5","gpt-oss","gpt-oss-120b","kimi-k2"]
  some tools where
    untrustedInput eq true
  some tools where
    sideEffect eq true
  approval in ["never","allowlist"]

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
AgentDojo	asr	0.548	—	none	Qwen3-235B-A22B	https://arxiv.org/html/2509.22830
AgentDojo	asr	0.514	—	none	GPT-oss-120b	https://arxiv.org/html/2509.22830
AgentDojo	asr	0.203	—	none	GLM-4.5	https://arxiv.org/html/2509.22830
AgentDojo	asr	0.172	—	none	Llama-4-Maverick	https://arxiv.org/html/2509.22830
InjecAgent	asr	0.794	—	none	Llama-4-Maverick	https://arxiv.org/html/2509.22830
InjecAgent	asr	0.573	—	none	GLM-4.5	https://arxiv.org/html/2509.22830
InjecAgent	asr	0.394	—	none	Qwen3-235B-A22B	https://arxiv.org/html/2509.22830
InjecAgent	asr	0.142	—	none	GPT-oss-120b	https://arxiv.org/html/2509.22830

Report a problem JSON