{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0213",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Claude 3.5 Sonnet AgentDojo-Inspect ASR rises from 57% at k=1 to 80% at k=25.",
  "details": "## What the vulnerability is\n\nClaude 3.5 Sonnet becomes much more exposed when an attacker gets repeated attempts. NIST AgentDojo-Inspect reports average ASR across five RCE, database-exfiltration, and phishing tasks rising from 57% at one attempt to 80% at 25 attempts. AgentHarm separately reports 13.5% harm with no attack and 68.7% under its jailbreak template, with refusal falling from 85.2% to 16.7%. AgentDojo-Inspect uses simulated task tools; the finding is about repetition and tool permissions, not a claim that Anthropic itself executed the RCE.\n\n## Which configuration is exposed\n\nThe exposed model is claude-3-5-sonnet-20241022 behind an agent with RCE, database, email, or comparable side-effecting tools that ingest untrusted content and auto-approve calls. A recognisable example is a coding or workspace agent that reads an issue or document and can run a shell command or send a message without an approval boundary. Egress should be recorded for email, HTTP, or database export tools. The user remains benign; the attacker controls the injected content.\n\n## How ACVE detects it\n\nThe matcher selects Claude 3.5 Sonnet through model.id or models[], checks untrustedInput and sideEffect tool witnesses, and requires never or allowlist approval. A dated snapshot and complete tool metadata can confirm; an alias or model server with unknown tools is only possible. The lock cannot see adaptive attackers, prompt filters, or hidden server safeguards. Those details belong in safeguards and in the evaluation record, not in an inference from the model id.\n\n## Fix\n\n1. Change approval to ask and keep it active for commands, database reads, and outbound messages. 2. Limit retries and add an injection classifier before the action planner. 3. Where a model change is possible, use Claude Opus 4.5 or later; the 2026 competition reports 0.5% per-attempt for Opus 4.5 compared with repeated Claude 3.5 task ASR reaching 80%. 4. Re-run the five tasks at k=1 and k=25 after each defence change.\n\n## Grounding needed\n\nPin claude-3-5-sonnet-20241022, the AgentDojo-Inspect commit and five-task selection, the AgentHarm v2 split if used, attack templates, seeds, attempt budget, judge, tools, and approval. R7 confidence is H for the NIST and AgentHarm primary-source values. Severity uses 0.80 at k=25, not the lower single-attempt figure. State that AgentHarm needs a jailbreak template while the NIST injection path does not.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "claude-3-5-sonnet"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations"
    },
    {
      "type": "EVIDENCE",
      "url": "https://arxiv.org/html/2410.09024v2"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "AgentDojo-Inspect",
          "benchmarkVersion": "2025",
          "attack": "RCE, database-exfiltration, and phishing tasks",
          "defense": "none",
          "metric": "asr",
          "value": 0.57,
          "k": 1,
          "model": {
            "id": "claude-3-5-sonnet-20241022",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated AgentDojo and new task tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations",
          "note": "simulated tools; five-task average"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo-Inspect",
          "benchmarkVersion": "2025",
          "attack": "RCE, database-exfiltration, and phishing tasks",
          "defense": "none",
          "metric": "asr",
          "value": 0.8,
          "k": 25,
          "model": {
            "id": "claude-3-5-sonnet-20241022",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated AgentDojo and new task tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://www.nist.gov/news-events/news/2025/01/technical-blog-strengthening-ai-agent-hijacking-evaluations",
          "note": "simulated tools; five-task average"
        },
        {
          "kind": "eval",
          "benchmark": "AgentHarm no-attack",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request; no jailbreak needed",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.135,
          "model": {
            "id": "Claude 3.5 Sonnet",
            "quant": null
          },
          "setup": {
            "tools": [
              "104 synthetic tools without side effects"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "comparison; no jailbreak needed"
        },
        {
          "kind": "eval",
          "benchmark": "AgentHarm template",
          "benchmarkVersion": "2024",
          "attack": "direct harmful user request with jailbreak template",
          "defense": "none",
          "metric": "harm-score",
          "value": 0.687,
          "model": {
            "id": "Claude 3.5 Sonnet",
            "quant": null
          },
          "setup": {
            "tools": [
              "104 synthetic tools without side effects"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2410.09024v2",
          "note": "comparison; no jailbreak needed for baseline"
        },
        {
          "kind": "eval",
          "benchmark": "AgentDojo comparison",
          "benchmarkVersion": "2024",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.0111,
          "model": {
            "id": "claude-3-5-sonnet-20241022",
            "quant": null
          },
          "setup": {
            "tools": [
              "simulated stateful workspace tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://agentdojo.spylab.ai/results/",
          "note": "comparison; simulated tools"
        },
        {
          "kind": "eval",
          "benchmark": "2026 IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.005,
          "model": {
            "id": "Claude Opus 4.5",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://arxiv.org/html/2603.15714",
          "note": "comparison; competition per-attempt"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "claude-3-5-sonnet"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "claude-3-5-sonnet"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Require approval and move repeated-injection workloads to Opus 4.5 or later.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Repeated attempts turn a 57% single-attempt path into 80% at k=25 without a human boundary."
          },
          {
            "type": "reconfigure",
            "target": "agent.model",
            "to": "claude-opus-4-5",
            "why": "The cited 2026 competition comparison is 0.5% per attempt for Opus 4.5."
          }
        ]
      }
    }
  }
}