ACVE-2026-0206

The configuration

Configuration label

model.family gpt-oss-120b | family gpt-oss-120b + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: gpt-oss-120b — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "gpt-oss-120b" ]
    • some models
      • family in [ "gpt-oss-120b" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

The R7 row for gpt-oss-120b reports an AgentDojo ChatInject change from 0.3% to 51.4% ASR. The number is a search excerpt of the ChatInject paper rather than a value visible in the fetched primary text, so it is useful warning evidence, not a fully auditable reproduction. AgentDojo uses simulated stateful tools and the ChatInject variant changes the text presented to the model. The comparison is therefore between ordinary tool-output formatting and forged conversational turns, not between two weight files.

Which configuration is exposed

A gpt-oss-120b agent is exposed when fetched or submitted content is placed directly into the prompt, a shell, filesystem, browser, or network-write tool is available, and the harness auto-approves the call. Think of a local gpt-oss-120b service behind Continue or Open WebUI with a repository reader and command tool. The egress attribute matters because a successful instruction can move secrets off host; sideEffect captures the command or write even when egress is not known.

How ACVE detects it

ACVE matches the gpt-oss-120b family on the selected model or models[] and checks for untrustedInput plus sideEffect with approval never or allowlist. A pinned local digest and visible tools are confirmable. An undated model alias, a server that hides tools, or a missing digest remains possible. The lock cannot infer whether ChatInject-resistant serialization, a classifier, or a planner was enabled; only safeguards recorded during discovery can explain a safe runtime.

Fix

1. Turn on a template-token sanitiser before tool results enter the gpt-oss prompt. 2. Add an injection classifier or tool_filter and treat uncertain results as untrusted. 3. Change agent.approval to ask for command, file, and network effects. 4. Re-run the ordinary and ChatInject variants on the pinned quantisation; do not use the 0.3% baseline as evidence that the 51.4% path is closed.

Grounding needed

Pin the gpt-oss-120b model digest, quantisation, tokenizer/template, ChatInject and AgentDojo revisions, the excerpted table or artefact, attack strings, seeds, and tool policy. R7 assigns L confidence because 0.3% and 51.4% were not in the fetched primary text. The simulated-tool limitation must remain in the report, and a second party should reproduce before this candidate is treated as a measured product defect.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Sanitise gpt-oss tool output, classify injections, and require approval.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2509.22830