ACVE-2026-0218

The configuration

Configuration label

model.family gpt-5 | family gpt-5 + untrustedInput=true + sideEffect=true + approval never|allowlist

Affected entries

• Model: gpt-5 — ECOSYSTEM (introduced 0)

Matcher

• all
  • any
    • all
      • model.id exists
      • model.family in [ "gpt-5" ]
    • some models
      • family in [ "gpt-5" ]
  • all
    • some tools
      • untrustedInput eq true
    • some tools
      • sideEffect eq true
  • approval in [ "never", "allowlist" ]

Threat

Attacker

content-author

Vector

prompt-injection

Outcome

harmful-action

Evidence

Why it is exploitable

What the vulnerability is

The Gray Swan IPI report quoted in R7 gives different indirect-injection ASRs for GPT-5.6 effort tiers at k=15: Sol 20.0%, Terra 30.4%, and Luna 43.9%. It also reports GPT-5.5 at 20.8% and Sol at 3.1% for k=1. The same weights therefore do not imply the same resistance when effort changes. The numbers are from a competitor-published secondary report, and the agents use the live competition’s tool/coding/computer surfaces; they are not a text-only jailbreak score.

Which configuration is exposed

The exposed configuration is a GPT-5.6 Luna or Terra effort tier in a tool-calling agent that reads attacker-controlled web, email, repository, or MCP content and auto-approves side effects. A practical example is an API agent with a browser or function-calling tool and effort set by a global model setting rather than per-risk policy. untrustedInput identifies the content path, sideEffect the action path, and egress the route for publishing or uploading data.

How ACVE detects it

The matcher selects the GPT-5 family through model.id or models[], then requires untrustedInput and sideEffect tools and approval never or allowlist. A dated GPT-5.6 identity with effort recorded can confirm the match. An undated GPT-5 alias, missing effort, or model server with unknown tools is possible. Lock discovery cannot infer server-side effort or injection defences; those values must be explicitly recorded in model.effort and safeguards.

Fix

1. Reconfigure agent.model.effort to sol and pin the dated GPT-5.6 identity. R7 reports Sol at 20.0% versus Terra 30.4% and Luna 43.9% at k=15. 2. Require approval for side-effecting calls while validating the tier. 3. Re-run the same Gray Swan scenario set at k=1 and k=15; lower effort is not a substitute for a classifier. 4. Keep egress restricted until the paired result is known.

Grounding needed

Pin the GPT-5.6 tier id, effort setting, provider date, competition scenario and attack strings, seeds, surface, approval, and any guardrail layer. R7 confidence is L because the values are secondary and quoted from a competitor-published card rather than a primary table fetched in the research session. Severity uses Luna’s 43.9% k=15 value, not the 3.1% k=1 comparison, and a primary reproduction is needed.

Underlying CVEs / aliases

No CVE assigned. behavioural — no code defect; evidence is an evaluation

Detect

npx @pickbitsai/acve audit

For CI, emit SARIF with npx @pickbitsai/acve audit --format sarif --out acve.sarif --apply and upload it with GitHub code scanning.

Fix

Set GPT-5.6 effort to Sol, keep approval on, and rerun the IPI curve.

Validation

No validation entries recorded.

Grounding

No grounding checks recorded.

References

EVIDENCE

• https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/