{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0214",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "Unmanaged Claude computer-use surfaces reach 78.6% ASR at k=200 without safeguards.",
  "details": "## What the vulnerability is\n\nAnthropic model safety varies sharply by surface and safeguards. For Opus 4.6 in a GUI computer-use harness, R7 reports 17.8% ASR at k=1 and 78.6% at k=200 with safeguards off, falling to 57.1% at k=200 with safeguards. Coding-harness ASR is 0% over 200 attempts. A secondary report gives Opus 4.8 browser raw 31.5% per attempt versus 0.5% safeguarded, and Sonnet 4.6 raw 50.7%; coding is 7.03% to 2.09%. Tools are real GUI/browser surfaces in these vendor evaluations.\n\n## Which configuration is exposed\n\nThis advisory targets Claude Opus 4.6, Sonnet 4.6, or Opus 4.8 called through a third-party API computer-use or browser harness that passes screenshots and page content while Anthropic-managed classifiers are absent. The recognisable configuration is a screenshot-driven browser with navigation and form tools, auto approval, and untrusted page text. The dangerous attributes are untrustedInput from pages, sideEffect from clicks or submissions, and egress from the browser session.\n\n## How ACVE detects it\n\nThe matcher recognizes the three Claude families and requires untrustedInput, sideEffect, and approval never or allowlist. A dated model plus explicit browser/computer tools confirms the local configuration. A floating API alias or unknown server-side safeguards yields possible rather than confirmed. ACVE cannot inspect Anthropic classifiers that are not in the lock; it can record them only when the surface discovery or safeguards field says they are enabled.\n\n## Fix\n\n1. Route browser or computer-use work through the Anthropic-managed safeguarded surface and record the classifier state. 2. Add approval for navigation, downloads, form submission, and other side effects. 3. For Opus 4.6, set thinking effort off while validating: R7 reports 14.8% with thinking off versus 21.7% on at k=100. 4. Do not generalise the 0% coding result to GUI work; keep surface-specific fixtures.\n\n## Grounding needed\n\nPin dated model ids, harness surface, vendor card or benchmark revision, screenshot/task set, attack strings, seeds, attempt budget, safeguard mode, and approval. R7 confidence is L–M because the Opus 4.6 and 4.8 values are secondary reports of vendor cards. Severity uses 78.6% at k=200 without safeguards. A primary-card reproduction is required before publication, especially for the 31.5% and 50.7% browser figures.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "claude-opus-4-6"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers"
    },
    {
      "type": "EVIDENCE",
      "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged"
    }
  ],
  "database_specific": {
    "severity": "CRITICAL",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "arbitrary-command"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade GUI computer-use",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive computer-use prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.178,
          "k": 1,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "screen",
              "mouse",
              "keyboard"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade GUI computer-use",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive computer-use prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.786,
          "k": 200,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "screen",
              "mouse",
              "keyboard"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade GUI computer-use",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive computer-use prompt injection",
          "defense": "safeguards",
          "metric": "asr",
          "value": 0.571,
          "k": 200,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "screen",
              "mouse",
              "keyboard"
            ],
            "approval": "auto",
            "defences": [
              "safeguards"
            ]
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade coding",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive coding prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0,
          "k": 200,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "terminal"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "comparison; secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade thinking",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.217,
          "k": 100,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "agent tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "secondary source; thinking on"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic Shade thinking",
          "benchmarkVersion": "2026-02",
          "attack": "adaptive prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.148,
          "k": 100,
          "model": {
            "id": "Claude Opus 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "agent tools"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/prompt-injection-measurable-security-metric-one-ai-developer-publishes-numbers",
          "note": "comparison; secondary source; thinking off"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic browser evaluation",
          "benchmarkVersion": "2026-05",
          "attack": "browser prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.315,
          "model": {
            "id": "Claude Opus 4.8",
            "quant": null
          },
          "setup": {
            "tools": [
              "real browser"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic browser evaluation",
          "benchmarkVersion": "2026-05",
          "attack": "browser prompt injection",
          "defense": "safeguards",
          "metric": "asr",
          "value": 0.005,
          "model": {
            "id": "Claude Opus 4.8",
            "quant": null
          },
          "setup": {
            "tools": [
              "real browser"
            ],
            "approval": "auto",
            "defences": [
              "safeguards"
            ]
          },
          "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged",
          "note": "secondary source; comparison"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic browser evaluation",
          "benchmarkVersion": "2026-05",
          "attack": "browser prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.507,
          "model": {
            "id": "Claude Sonnet 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "real browser"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic coding evaluation",
          "benchmarkVersion": "2026-05",
          "attack": "coding prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.0703,
          "model": {
            "id": "Claude Sonnet 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "coding harness"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged",
          "note": "secondary source"
        },
        {
          "kind": "eval",
          "benchmark": "Anthropic coding evaluation",
          "benchmarkVersion": "2026-05",
          "attack": "coding prompt injection",
          "defense": "safeguards",
          "metric": "asr",
          "value": 0.0209,
          "model": {
            "id": "Claude Sonnet 4.6",
            "quant": null
          },
          "setup": {
            "tools": [
              "coding harness"
            ],
            "approval": "auto",
            "defences": [
              "safeguards"
            ]
          },
          "url": "https://venturebeat.com/security/anthropic-browser-agent-hijacked-31-percent-before-safeguards-engaged",
          "note": "secondary source; comparison"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "claude-opus-4-6",
                      "claude-sonnet-4-6",
                      "claude-opus-4-8"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "claude-opus-4-6",
                    "claude-sonnet-4-6",
                    "claude-opus-4-8"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Use managed Claude safeguards, ask before browser effects, and disable Opus 4.6 thinking.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "defence:anthropic-managed-classifiers",
            "to": "on",
            "why": "The cited Opus 4.8 browser comparison falls from 31.5% raw to 0.5% safeguarded."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Screenshots and page content must not directly authorize navigation or form submission."
          },
          {
            "type": "reconfigure",
            "target": "agent.model.effort",
            "to": "off",
            "why": "R7 reports Opus 4.6 at 14.8% with thinking off versus 21.7% on at k=100."
          }
        ]
      }
    }
  }
}