{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0209",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Qwen2-72B reaches 87.0% DPI and 98.5% mixed ASB ASR.",
  "details": "## What the vulnerability is\n\nQwen2-72B has 87.0% ASB DPI ASR, 21.4% OPI ASR, and 98.5% mixed ASR with no defence and auto approval. The same R7 table gives Qwen2-7B as 55.2%, 9.0%, and 76.0%, which is a useful size comparison rather than evidence that scaling fixes the issue. ASB tools are simulated and stateful. The mixed score is the relevant attacker-budget number here because it combines direct and observation injection against an agent that can take actions.\n\n## Which configuration is exposed\n\nACVE is concerned with Qwen2-72B tool agents that ingest web, email, repository, or MCP content and expose side-effecting operations under auto approval. In practice this could be a pinned Qwen2-72B-Instruct service with a browser fetch, shell command, and file write in the same loop. The tool attributes should be read literally: untrustedInput identifies attacker-controlled content, sideEffect identifies an action, and egress identifies an outward channel for stolen data.\n\n## How ACVE detects it\n\nThe exact branches match qwen2 in model.id or a models[] member, require untrustedInput and sideEffect witnesses, and reject only approval modes outside never and allowlist. A full pinned lock can yield confirmed; qwen2:latest, undated aliases, or a model server whose tools are unknown remain possible. ACVE has no runtime trace of a safety filter. A defence counts only when it is captured in safeguards and, ideally, paired with evidence for the same tasks.\n\n## Fix\n\n1. Require approval for side-effecting calls. 2. Prefer a model change to Qwen3 only with a tool-output template sanitiser and classifier: R7 records 54.8% ChatInject ASR for Qwen3, lower than Qwen2-72B mixed at 98.5% but still unsafe for autonomous writes. 3. Keep the mixed, DPI, and OPI scores separate in regression reports. 4. Restrict egress while the safe configuration is being measured.\n\n## Grounding needed\n\nPin Qwen2-72B-Instruct bf16 identity, ASB revision and Table 5 suite, attack strings, seeds, tool schemas, and auto approval. R7 confidence is H for the ASB values. Because ASB reports scenario ASR rather than a repeated-attempt curve in the row, the severity calculation uses the 98.5% mixed result and labels the simulated-tool limitation explicitly. A second party should run the same complete suite on the exact digest.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "qwen2"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2410.02644"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "ASB DPI",
          "benchmarkVersion": "2025",
          "attack": "direct prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.87,
          "model": {
            "id": "Qwen2-72B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB OPI",
          "benchmarkVersion": "2025",
          "attack": "observation prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.214,
          "model": {
            "id": "Qwen2-72B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB mixed",
          "benchmarkVersion": "2025",
          "attack": "mixed direct and observation injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.985,
          "model": {
            "id": "Qwen2-72B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB DPI comparison",
          "benchmarkVersion": "2025",
          "attack": "direct prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.552,
          "model": {
            "id": "Qwen2-7B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB OPI comparison",
          "benchmarkVersion": "2025",
          "attack": "observation prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.09,
          "model": {
            "id": "Qwen2-7B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB mixed comparison",
          "benchmarkVersion": "2025",
          "attack": "mixed direct and observation injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.76,
          "model": {
            "id": "Qwen2-7B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "comparison; simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "qwen2"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "qwen2"
                  ]
                }
              }
            ]
          },
          {
            "some": "tools",
            "where": {
              "field": "sideEffect",
              "op": "eq",
              "value": true
            }
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Require approval and pair any Qwen2 model change with tool-output defence.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Do not let the 98.5% mixed ASB path directly authorize an effect."
          },
          {
            "type": "reconfigure",
            "target": "defence:classifier",
            "to": "on",
            "why": "Classify external tool output before it reaches the action planner."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "qwen3",
            "why": "R7 reports Qwen3 ChatInject at 54.8%, below Qwen2-72B mixed at 98.5%, but still requires defence."
          }
        ]
      }
    }
  }
}