ACVERogue and malicious agent events

Advisories › ACVE-2026-0218

ACVE-2026-0218 · Hijack shown in a test · LOW

Unverified · secondary sources only

WHAT HAPPENED

The agent carries out the injected irreversible action in the scenario, such as exfiltrating private data or making a transaction, instead of or alongside its task.

THE SETUP — is yours like this?

Harness
Any agent harness; the card ran the models through the Gray Swan IPI benchmark on their publicly available endpoints, www-cdn.anthropic.com
Model
GPT 5.6 Terra and GPT 5.6 Luna (GPT 5.6 Sol and GPT 5.5 measured alongside), www-cdn.anthropic.com
Goal
A coding, computer-use or tool-use task from the benchmark's 28 scenarios, in which an indirect injection attempts to induce an irreversible harmful action: private data exfiltration, data destruction, system compromise or an unintended financial transaction, www-cdn.anthropic.com
Tools
The tools of the Gray Swan IPI benchmark's coding, computer-use and tool-use scenarios; the models' public API endpoints with extended thinking, www-cdn.anthropic.com
Approval
The benchmark scenarios complete the injected action with no confirmation step; a success is an irreversible harmful action carried out, www-cdn.anthropic.com

WHAT TO CHANGE

Require approval for side-effecting tools; model choice is not a control.

  • Reconfigure agent.approval to ask. Every model in the source, including the most robust, was hijacked at a non-zero rate. Owner: operator
  • Reconfigure openai.api.injectionSafeguards to injection safeguards on the Terra and Luna endpoints. Recommended: within 15 attempts Terra was hijacked 30.4% and Luna 43.9% of the time, against 20.0% for Sol. Owner: model-provider

HARM, REACH AND RECOVERY

Harm
harmful-action
Reach
The tools of the benchmark's coding, computer-use and tool-use scenarios, www-cdn.anthropic.com (the network)
Condition
When tool output carries an injection selected for high transferability, www-cdn.anthropic.com
Evidence and responses
Demonstrated · researcher report

SOURCES

REPORT

ARTICLE

Technical details

Indirect injections drive agents on GPT 5.6 Terra or GPT 5.6 Luna, with side effects auto-approved, into irreversible actions at rates the Claude Opus 5 System Card measured well above GPT 5.6 Sol.

Severity
LOW · evaluation ASR (ASR 44%)
Status
Unverified
Kind
Hijack shown in a test
Modified
2026-09-25
Aliases
No CVE assigned — third-party evaluation of model behaviour; no code defect
CVE boundary
behavioural
Affected
  • Model: gpt-5.6-terra — all versions
  • Model: gpt-5.6-luna — all versions
Harness/product
gpt-5.6-terra + gpt-5.6-luna
Classes
prompt-injection-to-tool; CWE-1427
Taxonomy
LLM: LLM01; ASI: ASI01; ASI: ASI02; ATLAS: AML.T0051.001
First reported
2026-07-24 — Anthropic (Claude Opus 5 system card)
Input controlled by
content-author
Divergence
instruction-followed
Licence
CC-BY-4.0 advisories; MIT code

Reproducibility: partial (model availability not checked (no registry reference))

Claims

Confirmed means the statement matches the cited primary source. Nothing on this page has been reproduced.

Claims on this page have not been checked against primary sources.

Description

Threat

content-author · prompt-injection · harmful-action

What

The Claude Opus 5 System Card (Anthropic, 2026-07-24, section 5.2.1, Figure 5.2.1.B) reports the Gray Swan IPI benchmark: the probability of at least one successful indirect injection within 15 attempts was 30.4% for GPT 5.6 Terra and 43.9% for Luna, against 20.0% for Sol (3.1% at one attempt) and 20.8% for GPT 5.5. The card calls them "GPT 5.6 variants"; they are separate models with separate API ids, not effort settings.

Detection

The lockfile sees the model id, the tool attributes and the approval mode; it cannot see what safeguards the endpoint adds.

Fix

Require approval for side effects (ACVE-2026-0201). Caveats: the 1,130 attacks were selected for "high transferability"; all models used extended thinking; non-Claude models ran on "publicly available endpoints, which may or may not include additional safeguards"; k=15 is not a per-attempt rate.

Configuration

The rule ACVE's audit tool uses to recognise this configuration. The tool is not public yet.

and
  or
    model.id regex "gpt-5\\.6-(terra|luna)"
    some models where
      id regex "gpt-5\\.6-(terra|luna)"
  some tools where
    untrustedInput eq true
  some tools where
    sideEffect eq true
  approval in ["never","allowlist"]

Evidence

BenchmarkMetricValueAttemptsDefenceModelSource
Gray Swan Indirect Prompt Injection (IPI) benchmark, Q1 2026asr0.4391130unknown (public endpoint)GPT 5.6 Lunahttps://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf
Gray Swan Indirect Prompt Injection (IPI) benchmark, Q1 2026asr0.3041130unknown (public endpoint)GPT 5.6 Terrahttps://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf
Gray Swan Indirect Prompt Injection (IPI) benchmark, Q1 2026asr0.21130unknown (public endpoint)GPT 5.6 Solhttps://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf
Gray Swan Indirect Prompt Injection (IPI) benchmark, Q1 2026asr0.0311130unknown (public endpoint)GPT 5.6 Solhttps://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf
Gray Swan Indirect Prompt Injection (IPI) benchmark, Q1 2026asr0.2081130unknown (public endpoint)GPT 5.5https://www-cdn.anthropic.com/c5fbac3f0b1280a933ebd26d3cb8bb9f5bdeaf48/Claude%20Opus%205%20System%20Card.pdf

Report a problemJSON