{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0207",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "DeepSeek V3.1 and Kimi K2 reach 5.5% and 5.8% per-attempt IPI ASR.",
  "details": "## What the vulnerability is\n\nThe 2026 Gray Swan IPI competition reports 5.5% per-attempt ASR for DeepSeek V3.1 and 5.8% for Kimi K2 across tool, coding, and computer-use agents. R7 also gives pooled surface rates of 4.82% for tool use, 3.13% for computer use, and 2.51% for coding. Claude Opus 4.5 is a useful comparison at 0.5% overall, with 0.6% on tool use and 1.1% on computer use. The competition uses live agent surfaces, unlike ASB-style simulations.\n\n## Which configuration is exposed\n\nThe match is about open-weight model suppliers as deployed in agents that read attacker-controlled pages, issues, email, or MCP results and can then perform side effects. A concrete case is a DeepSeek V3.1 or Kimi K2 endpoint attached to a browser plus ticketing or shell tool with automatic approval. Tool egress is especially important for secrets; a purely read-only analysis agent is not the same exposure even when it receives untrusted text.\n\n## How ACVE detects it\n\nACVE accepts either family on model.id or in models[], then requires untrustedInput and sideEffect tool entries and approval never or allowlist. A dated provider identity plus complete tool list can confirm the finding. A floating API alias or an agent server with unknown tools is possible only. Safeguards such as a hosted classifier do not appear in the lock unless discovery records them, so the model family match is not a claim that every managed surface has the same rate.\n\n## Fix\n\n1. Set agent.approval to ask for every side-effecting operation. 2. If a model change is practical, use Claude Opus 4.5 or another pinned model and validate the same surface; Opus 4.5 is 0.5% overall in the cited competition versus 5.5% and 5.8% here. 3. Keep browser, coding, and tool-use results separate because pooled numbers hide surface differences. 4. Add an output classifier before enabling autonomous writes.\n\n## Grounding needed\n\nPin the DeepSeek V3.1 and Kimi K2 provider model ids, date, quantisation where local, competition commit or released test set, attack strings, seeds, surface, approval, and live tool policy. R7 confidence is H for the competition rates, but each is per-attempt and does not show a k=10 or k=100 curve. A reproduction should therefore report both the per-attempt rate and repeated-attempt ASR before deciding whether approval can be relaxed.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "deepseek-v3.1"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2603.15714"
    }
  ],
  "database_specific": {
    "severity": "MODERATE",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "2026 IPI competition",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.055,
          "model": {
            "id": "DeepSeek V3.1",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "competition per-attempt"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI competition",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.058,
          "model": {
            "id": "Kimi K2",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "competition per-attempt"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI pooled tool-use surface",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.0482,
          "model": {
            "id": "pooled models",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "comparison; pooled surface rate"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.005,
          "model": {
            "id": "Claude Opus 4.5",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "comparison; competition per-attempt"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.006,
          "model": {
            "id": "Claude Opus 4.5",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "comparison; tool-use surface"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.011,
          "model": {
            "id": "Claude Opus 4.5",
            "quant": null
          },
          "setup": {
            "tools": [
              "live computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "comparison; computer-use surface"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "deepseek-v3.1",
                      "kimi-k2"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "deepseek-v3.1",
                    "kimi-k2"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Require approval and prefer a pinned lower-ASR model for these agent surfaces.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "A human decision is needed before a live agent turns content into an effect."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "claude-opus-4-5",
            "why": "The competition comparison is 0.5% for Opus 4.5 versus 5.5% and 5.8% for the affected models."
          }
        ]
      }
    }
  }
}