ACVE-2026-0213

The configuration

Configuration label

model.family claude-3-5-sonnet | family claude-3-5-sonnet + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: claude-3-5-sonnet — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "claude-3-5-sonnet" ]
    • some models
      • family in [ "claude-3-5-sonnet" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

Claude 3.5 Sonnet becomes much more exposed when an attacker gets repeated attempts. NIST AgentDojo-Inspect reports average ASR across five RCE, database-exfiltration, and phishing tasks rising from 57% at one attempt to 80% at 25 attempts. AgentHarm separately reports 13.5% harm with no attack and 68.7% under its jailbreak template, with refusal falling from 85.2% to 16.7%. AgentDojo-Inspect uses simulated task tools; the finding is about repetition and tool permissions, not a claim that Anthropic itself executed the RCE.

Which configuration is exposed

The exposed model is claude-3-5-sonnet-20241022 behind an agent with RCE, database, email, or comparable side-effecting tools that ingest untrusted content and auto-approve calls. A recognisable example is a coding or workspace agent that reads an issue or document and can run a shell command or send a message without an approval boundary. Egress should be recorded for email, HTTP, or database export tools. The user remains benign; the attacker controls the injected content.

How ACVE detects it

The matcher selects Claude 3.5 Sonnet through model.id or models[], checks untrustedInput and sideEffect tool witnesses, and requires never or allowlist approval. A dated snapshot and complete tool metadata can confirm; an alias or model server with unknown tools is only possible. The lock cannot see adaptive attackers, prompt filters, or hidden server safeguards. Those details belong in safeguards and in the evaluation record, not in an inference from the model id.

Fix

1. Change approval to ask and keep it active for commands, database reads, and outbound messages. 2. Limit retries and add an injection classifier before the action planner. 3. Where a model change is possible, use Claude Opus 4.5 or later; the 2026 competition reports 0.5% per-attempt for Opus 4.5 compared with repeated Claude 3.5 task ASR reaching 80%. 4. Re-run the five tasks at k=1 and k=25 after each defence change.

Grounding needed

Pin claude-3-5-sonnet-20241022, the AgentDojo-Inspect commit and five-task selection, the AgentHarm v2 split if used, attack templates, seeds, attempt budget, judge, tools, and approval. R7 confidence is H for the NIST and AgentHarm primary-source values. Severity uses 0.80 at k=25, not the lower single-attempt figure. State that AgentHarm needs a jailbreak template while the NIST injection path does not.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Require approval and move repeated-injection workloads to Opus 4.5 or later.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations
• https://arxiv.org/html/2410.09024v2