ACVE-2026-0214

The configuration

Configuration label

model.family claude-opus-4-6|claude-sonnet-4-6|claude-opus-4-8 | family claude-opus-4-6|claude-sonnet-4-6|claude-opus-4-8 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: claude-opus-4-6 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "claude-opus-4-6", "claude-sonnet-4-6", "claude-opus-4-8" ]
    • some models
      • family in [ "claude-opus-4-6", "claude-sonnet-4-6", "claude-opus-4-8" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

arbitrary-command

Evidence

Why it is exploitable

What the vulnerability is

Anthropic model safety varies sharply by surface and safeguards. For Opus 4.6 in a GUI computer-use harness, R7 reports 17.8% ASR at k=1 and 78.6% at k=200 with safeguards off, falling to 57.1% at k=200 with safeguards. Coding-harness ASR is 0% over 200 attempts. A secondary report gives Opus 4.8 browser raw 31.5% per attempt versus 0.5% safeguarded, and Sonnet 4.6 raw 50.7%; coding is 7.03% to 2.09%. Tools are real GUI/browser surfaces in these vendor evaluations.

Which configuration is exposed

This advisory targets Claude Opus 4.6, Sonnet 4.6, or Opus 4.8 called through a third-party API computer-use or browser harness that passes screenshots and page content while Anthropic-managed classifiers are absent. The recognisable configuration is a screenshot-driven browser with navigation and form tools, auto approval, and untrusted page text. The dangerous attributes are untrustedInput from pages, sideEffect from clicks or submissions, and egress from the browser session.

How ACVE detects it

The matcher recognizes the three Claude families and requires untrustedInput, sideEffect, and approval never or allowlist. A dated model plus explicit browser/computer tools confirms the local configuration. A floating API alias or unknown server-side safeguards yields possible rather than confirmed. ACVE cannot inspect Anthropic classifiers that are not in the lock; it can record them only when the surface discovery or safeguards field says they are enabled.

Fix

1. Route browser or computer-use work through the Anthropic-managed safeguarded surface and record the classifier state. 2. Add approval for navigation, downloads, form submission, and other side effects. 3. For Opus 4.6, set thinking effort off while validating: R7 reports 14.8% with thinking off versus 21.7% on at k=100. 4. Do not generalise the 0% coding result to GUI work; keep surface-specific fixtures.

Grounding needed

Pin dated model ids, harness surface, vendor card or benchmark revision, screenshot/task set, attack strings, seeds, attempt budget, safeguard mode, and approval. R7 confidence is L–M because the Opus 4.6 and 4.8 values are secondary reports of vendor cards. Severity uses 78.6% at k=200 without safeguards. A primary-card reproduction is required before publication, especially for the 31.5% and 50.7% browser figures.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Use managed Claude safeguards, ask before browser effects, and disable Opus 4.6 thinking.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers
• https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged