{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0203",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Llama 4 ChatInject raises simulated InjecAgent ASR from 50.1% to 79.4%.",
  "details": "## What the vulnerability is\n\nChatInject shows that Llama 4 is unusually sensitive to role and turn markers embedded in tool output. InjecAgent reports 50.1% ASR in its baseline and 79.4% when the ChatInject format forges chat-template turns. R7 also lists an inferred AgentDojo change from 1.0% to 19.8%, but flags that value as an unverified search excerpt. The tools are simulated in InjecAgent; the result measures whether the agent follows the injected instruction, not real-world command execution. Llama 4 Scout and Maverick are not distinguished in the source.\n\n## Which configuration is exposed\n\nThe vulnerable shape is a Llama 4 API or local deployment whose raw tool result is concatenated into the next prompt without role-token sanitisation. It becomes actionable when a browser, repository, mail, or MCP tool accepts untrustedInput and another tool has sideEffect, while approval is auto or never. A recognisable example is a Llama 4 endpoint behind an agent framework that prints a fetched README containing fake assistant or user delimiters and then lets the model invoke shell or file tools without asking.\n\n## How ACVE detects it\n\nThe matcher checks the Llama 4 family through the selected model or models[] and then looks for separate untrustedInput and sideEffect tools plus approval never or allowlist. A known model and complete tool list can confirm the configuration. An API alias without a dated identity is possible rather than confirmed; an agent server that omits tool metadata is also possible. ACVE cannot tell whether the application stripped template tokens or ran Prompt Guard unless that runtime defence was captured in safeguards.\n\n## Fix\n\n1. Enable a template-token sanitiser that treats tool output as data and removes role, turn, and assistant-boundary markers before rendering it. 2. Run Prompt Guard 2 on tool output and log its decision. 3. Require agent.approval=ask for side-effecting calls until the sanitiser is demonstrated on the exact template. 4. Keep the template and tokenizer digest with the model record because ChatInject changes with that layer even when weights do not.\n\n## Grounding needed\n\nPin the Llama 4 model identity and chat template, InjecAgent and ChatInject commits, attack strings, prompt serialization, seeds, and whether tools were simulated. R7 confidence is M: the primary ChatInject source verifies the 50.1% and 79.4% values, but the model size and Scout/Maverick selection are unstated. Treat the 1.0% to 19.8% AgentDojo comparison as secondary-source context, not as a replacement for a reproducible full-suite run.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "llama-4"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2509.22830"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01",
          "ASI06"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "InjecAgent baseline",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.501,
          "model": {
            "id": "Llama 4",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated InjecAgent tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; model size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.794,
          "model": {
            "id": "Llama 4",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated InjecAgent tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "simulated tools; model size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.01,
          "model": {
            "id": "Llama 4",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "secondary source; size not stated"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.198,
          "model": {
            "id": "Llama 4",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "secondary source; size not stated"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "llama-4"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "llama-4"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Sanitise tool-output turns and require approval for Llama 4 actions.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:Prompt Guard 2",
            "to": "on",
            "why": "Filter indirect instructions before the model sees tool output."
          },
          {
            "type": "reconfigure",
            "target": "defence:template-token sanitiser",
            "to": "on",
            "why": "Prevent tool content from forging user, assistant, or turn boundaries."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Keep forged conversational turns from authorising a side effect while the sanitiser is validated."
          }
        ]
      }
    }
  }
}