ACVE-2026-0211

The configuration

Configuration label

model.family gpt-4o | family gpt-4o + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: gpt-4o — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "gpt-4o" ]
    • some models
      • family in [ "gpt-4o" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

GPT-4o has a pronounced defence toggle on the same AgentDojo workload: targeted ASR is 47.69% with no defence and 6.84% with tool_filter. R7 also records an ASB average of 64.4% across DPI, OPI, and mixed scenarios. The AgentDojo suites use simulated stateful tools, so the numbers measure task hijacking and security checks in that environment. GPT-5 is a comparison point at 0.2% on the SecAlign AgentDojo table, but that is a model comparison, not proof that a GPT-5 deployment is safe.

Which configuration is exposed

The exposed setup is dated gpt-4o-2024-05-13, or a GPT-4o family service, wired to untrusted email, web, repository, or MCP data while tool_filter and planner isolation are absent. It is recognisable as a GPT-4o agent with a browser or document reader plus shell, file, or API-write tool that auto-approves calls. Egress should be marked when a network tool can publish or upload data; sideEffect covers the action even when egress is unknown.

How ACVE detects it

The matcher has model branches for model.id and models[], then separate tool predicates for untrustedInput and sideEffect, and an approval branch for never or allowlist. A dated API id and discovered tools make the match confirmed. An undated GPT-4o alias or server with an unknown tool inventory makes it possible. The lock cannot know that tool_filter is active unless discovery records it under safeguards, so a model-only lock is insufficient to claim the 6.84% condition.

Fix

1. Enable tool_filter on tool results and preserve its decision in safeguards. 2. Add plan-then-execute isolation so the model cannot directly turn untrusted text into an effectful call. 3. Require approval for side effects while validating the defence. 4. If a model change is acceptable, use GPT-5; R7 reports 0.2% AgentDojo ASR compared with GPT-4o at 47.69%. Re-measure utility as well as ASR because the filtered run changes utility.

Grounding needed

Pin gpt-4o-2024-05-13, AgentDojo revision, important_instructions attack, four suites, attack strings, seeds, tool_filter version, planner mode, and approval. R7 confidence is H for the 47.69%, 6.84%, and 64.4% values. Severity uses the 64.4% attacker-budget ASB average; the simulated tools and utility trade-off must remain visible in the reproduction record.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Enable tool_filter, isolate planning, and require approval for GPT-4o effects.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://agentdojo.spylab.ai/results/
• https://arxiv.org/html/2410.02644