ACVE-2026-0207

The configuration

Configuration label

model.family deepseek-v3.1|kimi-k2 | family deepseek-v3.1|kimi-k2 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: deepseek-v3.1 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "deepseek-v3.1", "kimi-k2" ]
    • some models
      • family in [ "deepseek-v3.1", "kimi-k2" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

harmful-action

Evidence

Why it is exploitable

What the vulnerability is

The 2026 Gray Swan IPI competition reports 5.5% per-attempt ASR for DeepSeek V3.1 and 5.8% for Kimi K2 across tool, coding, and computer-use agents. R7 also gives pooled surface rates of 4.82% for tool use, 3.13% for computer use, and 2.51% for coding. Claude Opus 4.5 is a useful comparison at 0.5% overall, with 0.6% on tool use and 1.1% on computer use. The competition uses live agent surfaces, unlike ASB-style simulations.

Which configuration is exposed

The match is about open-weight model suppliers as deployed in agents that read attacker-controlled pages, issues, email, or MCP results and can then perform side effects. A concrete case is a DeepSeek V3.1 or Kimi K2 endpoint attached to a browser plus ticketing or shell tool with automatic approval. Tool egress is especially important for secrets; a purely read-only analysis agent is not the same exposure even when it receives untrusted text.

How ACVE detects it

ACVE accepts either family on model.id or in models[], then requires untrustedInput and sideEffect tool entries and approval never or allowlist. A dated provider identity plus complete tool list can confirm the finding. A floating API alias or an agent server with unknown tools is possible only. Safeguards such as a hosted classifier do not appear in the lock unless discovery records them, so the model family match is not a claim that every managed surface has the same rate.

Fix

1. Set agent.approval to ask for every side-effecting operation. 2. If a model change is practical, use Claude Opus 4.5 or another pinned model and validate the same surface; Opus 4.5 is 0.5% overall in the cited competition versus 5.5% and 5.8% here. 3. Keep browser, coding, and tool-use results separate because pooled numbers hide surface differences. 4. Add an output classifier before enabling autonomous writes.

Grounding needed

Pin the DeepSeek V3.1 and Kimi K2 provider model ids, date, quantisation where local, competition commit or released test set, attack strings, seeds, surface, approval, and live tool policy. R7 confidence is H for the competition rates, but each is per-attempt and does not show a k=10 or k=100 curve. A reproduction should therefore report both the per-attempt rate and repeated-attempt ASR before deciding whether approval can be relaxed.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and prefer a pinned lower-ASR model for these agent surfaces.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2603.15714