{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0208",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Gemma 2 9B/27B reach 87–100% ASB injection ASR with simulated tools.",
  "details": "## What the vulnerability is\n\nGemma 2 shows very high ASB prompt-injection rates with no defence and auto approval. For 9B bf16, ASB reports 87.1% DPI, 14.2% OPI, 92.2% mixed, and 48.0% average. For 27B bf16, the values are 96.8%, 14.2%, 100%, and 54.3%. ASB uses simulated tools, so these are agent benchmark outcomes rather than executions against a real shell. R7 separately says Gemma3-4B data are limited; that observation is not a numerical safety result and should not be blended into this claim.\n\n## Which configuration is exposed\n\nThe affected configuration is Gemma 2 9B or 27B in any autonomous tool agent that accepts untrusted observations and can perform side effects without approval. A reader-recognisable example is an Ollama gemma2 tag behind Open WebUI, Continue, or a custom ReAct loop with a web or repository fetch plus shell, filesystem, or HTTP-post tool. SideEffect is the dangerous bridge; egress can turn a successful ASB instruction into data theft, while a read-only tool remains less actionable.\n\n## How ACVE detects it\n\nThe matcher recognizes the Gemma 2 family in model or models[], then checks for an untrustedInput tool, a sideEffect tool, and approval never or allowlist. A pinned bf16 or quantised digest with listed tools can be confirmed; an Ollama latest tag and a server that does not expose tools are possible findings. Runtime classifier or planner state is not inferable from the model name. It must be written into safeguards for ACVE to distinguish a defended deployment.\n\n## Fix\n\n1. Remove side-effecting autonomous tools from Gemma 2 agents; R7 explicitly says not to deploy these models as autonomous tool agents on this evidence. 2. If the workflow cannot be removed, change approval to ask and make tool output read-only until a full reproduction demonstrates a safe pair. 3. Pin the model, quantisation, and template, because a Gemma 2 tag is not a behavioural identity.\n\n## Grounding needed\n\nPin Gemma 2 9B and 27B bf16 identities, ASB commit and Table 5 scenario definitions, attack strings, seeds, tool schemas, and approval state. R7 marks this H because the values are verified primary ASB results, while the tool execution remains simulated. Severity uses the 27B mixed value of 1.0, the highest attacker-relevant ASB rate; it is not a claim that every real tool call succeeds.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "gemma-2"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Model",
        "name": "gemma3"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2410.02644"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "ASB DPI",
          "benchmarkVersion": "2025",
          "attack": "direct prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.871,
          "model": {
            "id": "Gemma2-9B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB OPI",
          "benchmarkVersion": "2025",
          "attack": "observation prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.142,
          "model": {
            "id": "Gemma2-9B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB mixed",
          "benchmarkVersion": "2025",
          "attack": "mixed direct and observation injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.922,
          "model": {
            "id": "Gemma2-9B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB average",
          "benchmarkVersion": "2025",
          "attack": "ASB mixed suite",
          "defense": "none",
          "metric": "asr",
          "value": 0.48,
          "model": {
            "id": "Gemma2-9B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB DPI",
          "benchmarkVersion": "2025",
          "attack": "direct prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.968,
          "model": {
            "id": "Gemma2-27B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB OPI",
          "benchmarkVersion": "2025",
          "attack": "observation prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.142,
          "model": {
            "id": "Gemma2-27B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB mixed",
          "benchmarkVersion": "2025",
          "attack": "mixed direct and observation injection",
          "defense": "none",
          "metric": "asr",
          "value": 1,
          "model": {
            "id": "Gemma2-27B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB average",
          "benchmarkVersion": "2025",
          "attack": "ASB mixed suite",
          "defense": "none",
          "metric": "asr",
          "value": 0.543,
          "model": {
            "id": "Gemma2-27B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "gemma-2",
                      "gemma3"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "gemma-2",
                    "gemma3"
                  ]
                }
              }
            ]
          },
          {
            "some": "tools",
            "where": {
              "field": "sideEffect",
              "op": "eq",
              "value": true
            }
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Do not deploy Gemma 2 as an autonomous side-effecting tool agent.",
        "actions": [
          {
            "type": "remove",
            "target": "tool:sideEffect",
            "why": "R7 proposes removing autonomous side-effecting tools because ASB mixed ASR reaches 92.2% and 100%."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "If tools remain for a constrained test, require a human decision before every effect."
          }
        ]
      }
    }
  }
}