ACVE-2026-0208

The configuration

Configuration label

model.family gemma-2|gemma3 | family gemma-2|gemma3 + sideEffect=true + approval never|allowlist

Affected entries

• Model: gemma-2 — ECOSYSTEM (introduced 0)
• Model: gemma3 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "gemma-2", "gemma3" ]
    • some models
      • family in [ "gemma-2", "gemma3" ]
  • some tools
    • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

Gemma 2 shows very high ASB prompt-injection rates with no defence and auto approval. For 9B bf16, ASB reports 87.1% DPI, 14.2% OPI, 92.2% mixed, and 48.0% average. For 27B bf16, the values are 96.8%, 14.2%, 100%, and 54.3%. ASB uses simulated tools, so these are agent benchmark outcomes rather than executions against a real shell. R7 separately says Gemma3-4B data are limited; that observation is not a numerical safety result and should not be blended into this claim.

Which configuration is exposed

The affected configuration is Gemma 2 9B or 27B in any autonomous tool agent that accepts untrusted observations and can perform side effects without approval. A reader-recognisable example is an Ollama gemma2 tag behind Open WebUI, Continue, or a custom ReAct loop with a web or repository fetch plus shell, filesystem, or HTTP-post tool. SideEffect is the dangerous bridge; egress can turn a successful ASB instruction into data theft, while a read-only tool remains less actionable.

How ACVE detects it

The matcher recognizes the Gemma 2 family in model or models[], then checks for an untrustedInput tool, a sideEffect tool, and approval never or allowlist. A pinned bf16 or quantised digest with listed tools can be confirmed; an Ollama latest tag and a server that does not expose tools are possible findings. Runtime classifier or planner state is not inferable from the model name. It must be written into safeguards for ACVE to distinguish a defended deployment.

Fix

1. Remove side-effecting autonomous tools from Gemma 2 agents; R7 explicitly says not to deploy these models as autonomous tool agents on this evidence. 2. If the workflow cannot be removed, change approval to ask and make tool output read-only until a full reproduction demonstrates a safe pair. 3. Pin the model, quantisation, and template, because a Gemma 2 tag is not a behavioural identity.

Grounding needed

Pin Gemma 2 9B and 27B bf16 identities, ASB commit and Table 5 scenario definitions, attack strings, seeds, tool schemas, and approval state. R7 marks this H because the values are verified primary ASB results, while the tool execution remains simulated. Severity uses the 27B mixed value of 1.0, the highest attacker-relevant ASB rate; it is not a claim that every real tool call succeeds.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Do not deploy Gemma 2 as an autonomous side-effecting tool agent.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2410.02644