{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0206",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "gpt-oss-120b ChatInject is reported at 51.4% versus 0.3% baseline ASR.",
  "details": "## What the vulnerability is\n\nThe R7 row for gpt-oss-120b reports an AgentDojo ChatInject change from 0.3% to 51.4% ASR. The number is a search excerpt of the ChatInject paper rather than a value visible in the fetched primary text, so it is useful warning evidence, not a fully auditable reproduction. AgentDojo uses simulated stateful tools and the ChatInject variant changes the text presented to the model. The comparison is therefore between ordinary tool-output formatting and forged conversational turns, not between two weight files.\n\n## Which configuration is exposed\n\nA gpt-oss-120b agent is exposed when fetched or submitted content is placed directly into the prompt, a shell, filesystem, browser, or network-write tool is available, and the harness auto-approves the call. Think of a local gpt-oss-120b service behind Continue or Open WebUI with a repository reader and command tool. The egress attribute matters because a successful instruction can move secrets off host; sideEffect captures the command or write even when egress is not known.\n\n## How ACVE detects it\n\nACVE matches the gpt-oss-120b family on the selected model or models[] and checks for untrustedInput plus sideEffect with approval never or allowlist. A pinned local digest and visible tools are confirmable. An undated model alias, a server that hides tools, or a missing digest remains possible. The lock cannot infer whether ChatInject-resistant serialization, a classifier, or a planner was enabled; only safeguards recorded during discovery can explain a safe runtime.\n\n## Fix\n\n1. Turn on a template-token sanitiser before tool results enter the gpt-oss prompt. 2. Add an injection classifier or tool_filter and treat uncertain results as untrusted. 3. Change agent.approval to ask for command, file, and network effects. 4. Re-run the ordinary and ChatInject variants on the pinned quantisation; do not use the 0.3% baseline as evidence that the 51.4% path is closed.\n\n## Grounding needed\n\nPin the gpt-oss-120b model digest, quantisation, tokenizer/template, ChatInject and AgentDojo revisions, the excerpted table or artefact, attack strings, seeds, and tool policy. R7 assigns L confidence because 0.3% and 51.4% were not in the fetched primary text. The simulated-tool limitation must remain in the report, and a second party should reproduce before this candidate is treated as a measured product defect.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "gpt-oss-120b"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2509.22830"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01",
          "ASI06"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo baseline",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.003,
          "model": {
            "id": "gpt-oss-120b",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "secondary source; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo ChatInject",
          "benchmarkVersion": "2024",
          "attack": "forged chat-template turns in tool output",
          "defense": "none",
          "metric": "asr",
          "value": 0.514,
          "model": {
            "id": "gpt-oss-120b",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2509.22830",
          "note": "secondary source; simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "gpt-oss-120b"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "gpt-oss-120b"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Sanitise gpt-oss tool output, classify injections, and require approval.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:template-token sanitiser",
            "to": "on",
            "why": "Prevent forged role and turn markers from entering the prompt."
          },
          {
            "type": "reconfigure",
            "target": "defence:classifier",
            "to": "on",
            "why": "Reject uncertain external content before it reaches the action planner."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "The cited ChatInject path is high enough that side effects need a human decision."
          }
        ]
      }
    }
  }
}