{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0210",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Mistral Large 2 reaches 82.2% AgentHarm with no jailbreak needed.",
  "details": "## What the vulnerability is\n\nMistral Large 2 is exposed to direct harmful tool requests even without a jailbreak. AgentHarm reports harm scores of 82.2% for the no-attack request set and 80.5% with the template setting; refusal is only 1.1% and 0.0% respectively. R7 also mentions a 90.8% best-of-five value as inferred. AgentHarm uses 104 synthetic tools without side effects, so the benchmark measures model compliance with harmful requests, not a real command or data transfer. No jailbreak is needed: the user is the attacker.\n\n## Which configuration is exposed\n\nThe exposed configuration is Mistral Large 2, model id mistral-large-2407, embedded in an agent with shell, filesystem, browser, payment, messaging, or other side-effecting tools that are exposed to untrusted users. A concrete example is a customer-facing assistant that turns a user request into a tool call and auto-approves it. This advisory does not require untrusted external content; unlike the injection rows, the harmful instruction originates with the user.\n\n## How ACVE detects it\n\nACVE matches the Mistral Large 2 family and requires a sideEffect tool. The rule does not claim that approval is always absent, because AgentHarm is about direct misuse; a known model and visible tool inventory can confirm the model/tool exposure, while an alias or hidden server tool set remains possible. Lock discovery cannot judge user intent, guardrail prompts, or live classifier behavior. Those runtime safeguards must be recorded in safeguards and tested separately.\n\n## Fix\n\n1. Put an input and output guardrail classifier in front of every harmful-capable operation. 2. Require approval for high-impact tools even when a classifier allows the request. 3. Where feasible, move the agent to Llama 3.1 405B for this direct-use workload; AgentHarm reports 4.3% harm with and without its template versus Mistral Large 2 at 80.5% under the template. 4. Re-test the exact user tool set, not just chat refusal.\n\n## Grounding needed\n\nPin mistral-large-2407, the AgentHarm v2 dataset and runner, the 104-tool set, prompt templates, seeds, judge, and guardrail state. R7 confidence is H for the 82.2%, 80.5%, 1.1%, and 0.0% primary values; the best-of-five 90.8% is inferred. Severity uses the 82.2% harm score. Report plainly that the attack needs no jailbreak and that the published tools are synthetic and without side effects.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "mistral-large-2407"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2410.09024v2"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "unsafe-permission-mode"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI02"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "user",
        "vector": "jailbreak",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentHarm no-attack",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request; no jailbreak needed",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.822,
          "model": {
            "id": "mistral-large-2407",
            "quant": null
          },
          "setup": {
            "tools": [
              "104 synthetic tools without side effects"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "no jailbreak needed; synthetic tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentHarm template",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request with jailbreak template",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.805,
          "model": {
            "id": "mistral-large-2407",
            "quant": null
          },
          "setup": {
            "tools": [
              "104 synthetic tools without side effects"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "no jailbreak needed for baseline; synthetic tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentHarm best-of-five",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.908,
          "model": {
            "id": "mistral-large-2407",
            "quant": null
          },
          "setup": {
            "tools": [
              "synthetic tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "comparison; inferred in R7"
        },
        {
          "kind": "eval",
          "benchmark": "AgentHarm comparison",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request; no jailbreak needed",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.043,
          "model": {
            "id": "Llama 3.1 405B",
            "quant": "bf16"
          },
          "setup": {
            "tools": [
              "104 synthetic tools without side effects"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "comparison; no jailbreak needed"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "mistral-large-2407"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "mistral-large-2407"
                  ]
                }
              }
            ]
          },
          {
            "some": "tools",
            "where": {
              "field": "sideEffect",
              "op": "eq",
              "value": true
            }
          }
        ]
      },
      "fix": {
        "summary": "Add input/output guardrails and move direct-use agents to a safer model.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:classifier",
            "to": "on",
            "why": "Filter harmful user requests and tool outputs before an action is issued."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Human approval remains necessary for high-impact tools even when the guardrail allows the request."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "llama-3.1-405b",
            "why": "AgentHarm reports 4.3% harm for Llama 3.1 405B versus Mistral Large 2 at 82.2% without a jailbreak."
          }
        ]
      }
    }
  }
}