{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0211",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "GPT-4o reaches 47.69% AgentDojo ASR without tool_filter, versus 6.84% with it.",
  "details": "## What the vulnerability is\n\nGPT-4o has a pronounced defence toggle on the same AgentDojo workload: targeted ASR is 47.69% with no defence and 6.84% with tool_filter. R7 also records an ASB average of 64.4% across DPI, OPI, and mixed scenarios. The AgentDojo suites use simulated stateful tools, so the numbers measure task hijacking and security checks in that environment. GPT-5 is a comparison point at 0.2% on the SecAlign AgentDojo table, but that is a model comparison, not proof that a GPT-5 deployment is safe.\n\n## Which configuration is exposed\n\nThe exposed setup is dated gpt-4o-2024-05-13, or a GPT-4o family service, wired to untrusted email, web, repository, or MCP data while tool_filter and planner isolation are absent. It is recognisable as a GPT-4o agent with a browser or document reader plus shell, file, or API-write tool that auto-approves calls. Egress should be marked when a network tool can publish or upload data; sideEffect covers the action even when egress is unknown.\n\n## How ACVE detects it\n\nThe matcher has model branches for model.id and models[], then separate tool predicates for untrustedInput and sideEffect, and an approval branch for never or allowlist. A dated API id and discovered tools make the match confirmed. An undated GPT-4o alias or server with an unknown tool inventory makes it possible. The lock cannot know that tool_filter is active unless discovery records it under safeguards, so a model-only lock is insufficient to claim the 6.84% condition.\n\n## Fix\n\n1. Enable tool_filter on tool results and preserve its decision in safeguards. 2. Add plan-then-execute isolation so the model cannot directly turn untrusted text into an effectful call. 3. Require approval for side effects while validating the defence. 4. If a model change is acceptable, use GPT-5; R7 reports 0.2% AgentDojo ASR compared with GPT-4o at 47.69%. Re-measure utility as well as ASR because the filtered run changes utility.\n\n## Grounding needed\n\nPin gpt-4o-2024-05-13, AgentDojo revision, important_instructions attack, four suites, attack strings, seeds, tool_filter version, planner mode, and approval. R7 confidence is H for the 47.69%, 6.84%, and 64.4% values. Severity uses the 64.4% attacker-budget ASB average; the simulated tools and utility trade-off must remain visible in the reproduction record.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "gpt-4o"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://agentdojo.spylab.ai/results/"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2410.02644"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo no defence",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.4769,
          "model": {
            "id": "gpt-4o-2024-05-13",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://agentdojo.spylab.ai/results/",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo tool_filter",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "tool_filter",
          "metric": "targeted-asr",
          "value": 0.0684,
          "model": {
            "id": "gpt-4o-2024-05-13",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": [
              "tool_filter"
            ]
          },
          "url": "https://agentdojo.spylab.ai/results/",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "ASB average",
          "benchmarkVersion": "2025",
          "attack": "ASB mixed suite",
          "defense": "none",
          "metric": "asr",
          "value": 0.644,
          "model": {
            "id": "GPT-4o",
            "quant": null
          },
          "setup": {
            "tools": [
              "ASB simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.02644",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "important_instructions indirect prompt injection",
          "defense": "none",
          "metric": "targeted-asr",
          "value": 0.002,
          "model": {
            "id": "GPT-5",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "gpt-4o"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "gpt-4o"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Enable tool_filter, isolate planning, and require approval for GPT-4o effects.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:tool_filter",
            "to": "on",
            "why": "The same AgentDojo workload falls from 47.69% to 6.84% with tool_filter."
          },
          {
            "type": "reconfigure",
            "target": "defence:plan-then-execute",
            "to": "on",
            "why": "Separate untrusted observations from the executor’s final tool selection."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Keep the 47.69% no-defence path behind a human decision."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "gpt-5",
            "why": "R7 reports GPT-5 at 0.2% on AgentDojo versus GPT-4o at 47.69%."
          }
        ]
      }
    }
  }
}