ACVE-2026-0212

The configuration

Configuration label

model.family gemini-2.5 | family gemini-2.5 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: gemini-2.5 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "gemini-2.5" ]
    • some models
      • family in [ "gemini-2.5" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

harmful-action

Evidence

Why it is exploitable

What the vulnerability is

Gemini 2.5 Flash reaches 27.9% AgentDojo ASR, 14.3% WASP end-to-end ASR, and 0.1% InjecAgent ASR in the SecAlign table. The same table gives Gemini 2 Flash 11.3%, 8.3%, and 27.2%, while Gemini 3 Pro gives 2.3%, 1.2%, and 0.2%; the 2.3% AgentDojo value is the model-change comparison used by the fix. A 2026 live competition reports 8.5% per-attempt for Gemini 2.5 Pro. AgentDojo and InjecAgent simulate tools; WASP runs real web applications.

Which configuration is exposed

The rule covers Gemini 2.5 Flash and Pro in a tool-calling or web agent that reads attacker-controlled page, email, repository, or MCP content and can act without confirmation. A concrete example is Gemini 2.5 behind a browser agent with form submission and a web fetch, or an API agent with repository read and issue-write tools under auto approval. SideEffect captures the browser or API action; egress captures the network path that can carry secrets away.

How ACVE detects it

ACVE matches gemini-2.5 on the selected model or models[] and requires untrustedInput plus sideEffect and approval never or allowlist. A dated model id with discovered tools supports confirmation. Floating aliases and model servers that do not reveal their tool inventory are possible only. Hosted filters are not visible from the model name: the lock can distinguish them only when discovery records the runtime defence in safeguards.

Fix

1. Move the agent to Gemini 3 Pro and pin the dated identity; R7 gives 2.3% AgentDojo ASR versus Gemini 2.5 Flash at 27.9%. 2. Require approval for navigation, form submission, writes, and egress. 3. Keep a classifier or tool filter between untrusted content and the action planner. 4. Repeat AgentDojo, WASP, and InjecAgent separately because a lower API benchmark value does not automatically imply safe browser behavior.

Grounding needed

Pin the exact Gemini 2.5 Flash or Pro snapshot, model date, harness, benchmark commits, task suites, attack strings, seeds, auto approval, and vendor safeguard state. R7 confidence is H for the primary SecAlign and competition values. The competition value is per-attempt and the WASP value is end-to-end on real web apps; the reproduction should not silently substitute a text-only or simulated-tool run.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Move Gemini 2.5 agents to Gemini 3 Pro and keep approval on effects.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://arxiv.org/html/2507.02735
• https://arxiv.org/html/2603.15714