ACVE-2026-0209

The configuration

Configuration label

model.family qwen2 | family qwen2 + sideEffect=true + approval never|allowlist

Affected entries

• Model: qwen2 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "qwen2" ]
    • some models
      • family in [ "qwen2" ]
  • some tools
    • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

Qwen2-72B has 87.0% ASB DPI ASR, 21.4% OPI ASR, and 98.5% mixed ASR with no defence and auto approval. The same R7 table gives Qwen2-7B as 55.2%, 9.0%, and 76.0%, which is a useful size comparison rather than evidence that scaling fixes the issue. ASB tools are simulated and stateful. The mixed score is the relevant attacker-budget number here because it combines direct and observation injection against an agent that can take actions.

Which configuration is exposed

ACVE is concerned with Qwen2-72B tool agents that ingest web, email, repository, or MCP content and expose side-effecting operations under auto approval. In practice this could be a pinned Qwen2-72B-Instruct service with a browser fetch, shell command, and file write in the same loop. The tool attributes should be read literally: untrustedInput identifies attacker-controlled content, sideEffect identifies an action, and egress identifies an outward channel for stolen data.

How ACVE detects it

The exact branches match qwen2 in model.id or a models[] member, require untrustedInput and sideEffect witnesses, and reject only approval modes outside never and allowlist. A full pinned lock can yield confirmed; qwen2:latest, undated aliases, or a model server whose tools are unknown remain possible. ACVE has no runtime trace of a safety filter. A defence counts only when it is captured in safeguards and, ideally, paired with evidence for the same tasks.

Fix

1. Require approval for side-effecting calls. 2. Prefer a model change to Qwen3 only with a tool-output template sanitiser and classifier: R7 records 54.8% ChatInject ASR for Qwen3, lower than Qwen2-72B mixed at 98.5% but still unsafe for autonomous writes. 3. Keep the mixed, DPI, and OPI scores separate in regression reports. 4. Restrict egress while the safe configuration is being measured.

Grounding needed

Pin Qwen2-72B-Instruct bf16 identity, ASB revision and Table 5 suite, attack strings, seeds, tool schemas, and auto approval. R7 confidence is H for the ASB values. Because ASB reports scenario ASR rather than a repeated-attempt curve in the row, the severity calculation uses the 98.5% mixed result and labels the simulated-tool limitation explicitly. A second party should run the same complete suite on the exact digest.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and pair any Qwen2 model change with tool-output defence.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2410.02644