ACVE-2026-0214 · Hijack shown in a test · MODERATE

Unverified · secondary sources only

WHAT HAPPENED

The agent performs the attacker's injected goal inside the GUI or web page it was asked to work in, and the environment's checker records the action.

THE SETUP — is yours like this?

Harness: A computer-use or browser agent built outside Anthropic's agentic products, which the cards say carry the injection safeguards by default (the matcher excludes claude-code and claude-desktop), www-cdn.anthropic.com
Model: Claude Opus 4.6 (extended and standard thinking) in the Opus 4.6 card; Claude Opus 4.8 and Claude Sonnet 4.6 (with thinking) in the Opus 4.8 card, www-cdn.anthropic.com
Goal: A computer-use task in a Shade GUI environment where the model interacts with the GUI directly, or a browser task in Anthropic's web environments where untrusted content is injected into pages the model views via screenshots or page reads, www-cdn.anthropic.com
Tools: GUI computer-use actions (screenshots and direct GUI interaction) in Shade computer-use environments; page reads and screenshots in browser-use environments; no injection classifier on tool responses in the without-safeguards condition, www-cdn.anthropic.com
Approval: Actions in the evaluation environments complete with no confirmation step; success is verified by a programmatic checker within the environment, www-cdn.anthropic.com

WHAT TO CHANGE

Add an injection detector and require approval for irreversible actions.

Reconfigure agent.approval to ask. Page and screenshot content must not authorise an action by itself. Owner: operator
Reconfigure harness.injectionClassifier to on for page and screenshot content. Recommended: the injections arrived through page reads and screenshots. Owner: harness-vendor
Reconfigure anthropic.api.injectionSafeguards to the agentic-product safeguards offered to agents built on the API. Recommended: with them Opus 4.8 browser-use success fell from 31.5% to 0.5% per attempt; which API surfaces include them is not stated. Owner: model-provider

HARM, REACH AND RECOVERY

Harm: harmful-action
Reach: The GUI and web pages of the test environments, acting through screenshots and direct input, www-cdn.anthropic.com (a browser session)
Condition: When page or screenshot content carries an injection and no injection classifier runs on it, www-cdn.anthropic.com
Evidence and responses: Demonstrated · vendor report

SOURCES

REPORT

Technical details

An injection in the page or screen makes a computer-use or browser agent on Claude Opus 4.6, Opus 4.8 or Sonnet 4.6 act for the attacker when auto-approved and without Anthropic's product safeguards.

Severity: MODERATE · evaluation ASR (ASR 79%)
Status: Unverified
Kind: Hijack shown in a test
Modified: 2026-09-25
Aliases: No CVE assigned — vendor evaluation of model behaviour; no code defect
CVE boundary: behavioural
Affected: Model: claude-opus-4-6 — all versions
Model: claude-opus-4 — all versions
Model: claude-sonnet-4-6 — all versions
Harness/product: claude-opus-4-6 + claude-opus-4 + claude-sonnet-4-6
Classes: prompt-injection-to-tool; CWE-1427
Taxonomy: LLM: LLM01; ASI: ASI01; ASI: ASI02; ATLAS: AML.T0051.001; ATLAS: AML.T0100
First reported: 2026-02-05 — Anthropic (Claude Opus 4.6 system card)
Input controlled by: content-author
Divergence: instruction-followed
Licence: CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference); trigger not published)

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

content-author · prompt-injection · harmful-action

What

Anthropic's system cards report indirect prompt injection with and without the safeguards deployed "by default to most of our agentic products"; which API surfaces include them is not stated. Opus 4.6, extended thinking, GUI computer use (Shade, Table 5.2.2.2.A): 17.8% at one attempt and 78.6% within 200 without; 9.7% and 57.1% with. Opus 4.8 browser use per attempt (Table 5.2.2.4.A): 31.5% without, 0.5% with; Sonnet 4.6: 50.7% and 23.6%.

Detection

The lockfile sees the harness, model id, surface and approval mode; it cannot see whether an injection classifier runs on page or screenshot content.

Fix

Add an injection detector on page and screenshot content and require approval for irreversible actions. Caveats: a "strong adversary optimized against Claude with always discoverable prompt injections in a simplified scenario"; browser attacks were sourced against Opus 4.7 and transferred; the figures age with every release.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  harness.id notIn ["claude-code","claude-desktop"]
  model.id regex "claude-(opus-4-[5-8]|sonnet-4-6)"
  surface in ["computer-use","browser"]
  approval in ["never","allowlist"]

Evidence

Benchmark	Metric	Value	Attempts	Defence	Model	Source
Shade adaptive attacker, GUI computer use	asr	0.178	—	none	Claude Opus 4.6 (extended thinking)	https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf
Shade adaptive attacker, GUI computer use	asr	0.786	—	none	Claude Opus 4.6 (extended thinking)	https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf
Shade adaptive attacker, GUI computer use	asr	0.097	—	Anthropic product safeguards	Claude Opus 4.6 (extended thinking)	https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf
Shade adaptive attacker, GUI computer use	asr	0.571	—	Anthropic product safeguards	Claude Opus 4.6 (extended thinking)	https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf
Shade adaptive attacker, GUI computer use	asr	0.2	—	none	Claude Opus 4.6 (standard thinking)	https://www-cdn.anthropic.com/14e4fb01875d2a69f646fa5e574dea2b1c0ff7b5.pdf
Anthropic internal browser-use evaluation	asr	0.315	129	none	Claude Opus 4.8	https://www-cdn.anthropic.com/0b4915911bb0d19eca5b5ee635c80fef830a37ea.pdf
Anthropic internal browser-use evaluation	asr	0.005	129	Anthropic product safeguards	Claude Opus 4.8	https://www-cdn.anthropic.com/0b4915911bb0d19eca5b5ee635c80fef830a37ea.pdf
Anthropic internal browser-use evaluation	asr	0.507	129	none	Claude Sonnet 4.6	https://www-cdn.anthropic.com/0b4915911bb0d19eca5b5ee635c80fef830a37ea.pdf
Anthropic internal browser-use evaluation	asr	0.236	129	Anthropic product safeguards	Claude Sonnet 4.6	https://www-cdn.anthropic.com/0b4915911bb0d19eca5b5ee635c80fef830a37ea.pdf

Report a problem JSON