{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0212",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Gemini 2.5 Flash reaches 27.9% AgentDojo and 14.3% WASP ASR.",
  "details": "## What the vulnerability is\n\nGemini 2.5 Flash reaches 27.9% AgentDojo ASR, 14.3% WASP end-to-end ASR, and 0.1% InjecAgent ASR in the SecAlign table. The same table gives Gemini 2 Flash 11.3%, 8.3%, and 27.2%, while Gemini 3 Pro gives 2.3%, 1.2%, and 0.2%; the 2.3% AgentDojo value is the model-change comparison used by the fix. A 2026 live competition reports 8.5% per-attempt for Gemini 2.5 Pro. AgentDojo and InjecAgent simulate tools; WASP runs real web applications.\n\n## Which configuration is exposed\n\nThe rule covers Gemini 2.5 Flash and Pro in a tool-calling or web agent that reads attacker-controlled page, email, repository, or MCP content and can act without confirmation. A concrete example is Gemini 2.5 behind a browser agent with form submission and a web fetch, or an API agent with repository read and issue-write tools under auto approval. SideEffect captures the browser or API action; egress captures the network path that can carry secrets away.\n\n## How ACVE detects it\n\nACVE matches gemini-2.5 on the selected model or models[] and requires untrustedInput plus sideEffect and approval never or allowlist. A dated model id with discovered tools supports confirmation. Floating aliases and model servers that do not reveal their tool inventory are possible only. Hosted filters are not visible from the model name: the lock can distinguish them only when discovery records the runtime defence in safeguards.\n\n## Fix\n\n1. Move the agent to Gemini 3 Pro and pin the dated identity; R7 gives 2.3% AgentDojo ASR versus Gemini 2.5 Flash at 27.9%. 2. Require approval for navigation, form submission, writes, and egress. 3. Keep a classifier or tool filter between untrusted content and the action planner. 4. Repeat AgentDojo, WASP, and InjecAgent separately because a lower API benchmark value does not automatically imply safe browser behavior.\n\n## Grounding needed\n\nPin the exact Gemini 2.5 Flash or Pro snapshot, model date, harness, benchmark commits, task suites, attack strings, seeds, auto approval, and vendor safeguard state. R7 confidence is H for the primary SecAlign and competition values. The competition value is per-attempt and the WASP value is end-to-end on real web apps; the reproduction should not silently substitute a text-only or simulated-tool run.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "gemini-2.5"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2507.02735"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2603.15714"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.279,
          "model": {
            "id": "Gemini 2.5 Flash",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "WASP end-to-end",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.143,
          "model": {
            "id": "Gemini 2.5 Flash",
            "quant": null
          },
          "setup": {
            "tools": [
              "real GitLab web app",
              "real Reddit web app"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "real tools"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.001,
          "model": {
            "id": "Gemini 2.5 Flash",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI competition",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.085,
          "model": {
            "id": "Gemini 2.5 Pro",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "competition per-attempt"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.023,
          "model": {
            "id": "Gemini 3 Pro",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "WASP comparison",
          "benchmarkVersion": "2025",
          "attack": "web-agent prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.012,
          "model": {
            "id": "Gemini 3 Pro",
            "quant": null
          },
          "setup": {
            "tools": [
              "real web apps"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; real tools"
        },
        {
          "kind": "eval",
          "benchmark": "InjecAgent comparison",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.002,
          "model": {
            "id": "Gemini 3 Pro",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2507.02735",
          "note": "comparison; simulated tools"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "gemini-2.5"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "gemini-2.5"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Move Gemini 2.5 agents to Gemini 3 Pro and keep approval on effects.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "gemini-3-pro",
            "why": "Gemini 3 Pro is 2.3% on AgentDojo versus Gemini 2.5 Flash at 27.9%."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Do not let web or tool content directly authorize navigation, writes, or egress."
          }
        ]
      }
    }
  }
}