{
  "schema_version": "1.6.0",
  "id": "ACVE-2026-0218",
  "aliases": [],
  "published": "2026-09-20T00:00:00Z",
  "modified": "2026-09-20T00:00:00Z",
  "summary": "GPT-5.6 Luna reaches 43.9% IPI ASR at k=15, above Terra and Sol.",
  "details": "## What the vulnerability is\n\nThe Gray Swan IPI report quoted in R7 gives different indirect-injection ASRs for GPT-5.6 effort tiers at k=15: Sol 20.0%, Terra 30.4%, and Luna 43.9%. It also reports GPT-5.5 at 20.8% and Sol at 3.1% for k=1. The same weights therefore do not imply the same resistance when effort changes. The numbers are from a competitor-published secondary report, and the agents use the live competition’s tool/coding/computer surfaces; they are not a text-only jailbreak score.\n\n## Which configuration is exposed\n\nThe exposed configuration is a GPT-5.6 Luna or Terra effort tier in a tool-calling agent that reads attacker-controlled web, email, repository, or MCP content and auto-approves side effects. A practical example is an API agent with a browser or function-calling tool and effort set by a global model setting rather than per-risk policy. untrustedInput identifies the content path, sideEffect the action path, and egress the route for publishing or uploading data.\n\n## How ACVE detects it\n\nThe matcher selects the GPT-5 family through model.id or models[], then requires untrustedInput and sideEffect tools and approval never or allowlist. A dated GPT-5.6 identity with effort recorded can confirm the match. An undated GPT-5 alias, missing effort, or model server with unknown tools is possible. Lock discovery cannot infer server-side effort or injection defences; those values must be explicitly recorded in model.effort and safeguards.\n\n## Fix\n\n1. Reconfigure agent.model.effort to sol and pin the dated GPT-5.6 identity. R7 reports Sol at 20.0% versus Terra 30.4% and Luna 43.9% at k=15. 2. Require approval for side-effecting calls while validating the tier. 3. Re-run the same Gray Swan scenario set at k=1 and k=15; lower effort is not a substitute for a classifier. 4. Keep egress restricted until the paired result is known.\n\n## Grounding needed\n\nPin the GPT-5.6 tier id, effort setting, provider date, competition scenario and attack strings, seeds, surface, approval, and any guardrail layer. R7 confidence is L because the values are secondary and quoted from a competitor-published card rather than a primary table fetched in the research session. Severity uses Luna’s 43.9% k=15 value, not the 3.1% k=1 comparison, and a primary reproduction is needed.",
  "affected": [
    {
      "package": {
        "ecosystem": "Model",
        "name": "gpt-5"
      },
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            }
          ]
        }
      ]
    }
  ],
  "references": [
    {
      "type": "EVIDENCE",
      "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/"
    }
  ],
  "database_specific": {
    "severity": "HIGH",
    "acve": {
      "specVersion": 1,
      "status": "candidate",
      "kind": "behavioural",
      "vulnClasses": [
        "prompt-injection-to-tool"
      ],
      "cwe": [
        "CWE-74"
      ],
      "taxonomy": {
        "owasp_asi": [
          "ASI01"
        ],
        "owasp_llm": [
          "LLM01"
        ]
      },
      "noCveReason": "behavioural — no code defect; evidence is an evaluation",
      "threat": {
        "attacker": "content-author",
        "vector": "prompt-injection",
        "outcome": "harmful-action"
      },
      "evidence": [
        {
          "kind": "eval",
          "benchmark": "Gray Swan IPI",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.2,
          "k": 15,
          "model": {
            "id": "GPT-5.6 Sol",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/",
          "note": "secondary source; competition per-attempt budget"
        },
        {
          "kind": "eval",
          "benchmark": "Gray Swan IPI",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.304,
          "k": 15,
          "model": {
            "id": "GPT-5.6 Terra",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/",
          "note": "secondary source; competition per-attempt budget"
        },
        {
          "kind": "eval",
          "benchmark": "Gray Swan IPI",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.439,
          "k": 15,
          "model": {
            "id": "GPT-5.6 Luna",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/",
          "note": "secondary source; competition per-attempt budget"
        },
        {
          "kind": "eval",
          "benchmark": "Gray Swan IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.208,
          "k": 15,
          "model": {
            "id": "GPT-5.5",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/",
          "note": "secondary source; comparison"
        },
        {
          "kind": "eval",
          "benchmark": "Gray Swan IPI comparison",
          "benchmarkVersion": "2026",
          "attack": "indirect prompt injection",
          "defense": "none",
          "metric": "asr",
          "value": 0.031,
          "k": 1,
          "model": {
            "id": "GPT-5.6 Sol",
            "quant": null
          },
          "setup": {
            "tools": [
              "live tool, coding, and computer-use agents"
            ],
            "approval": "auto",
            "defences": []
          },
          "url": "https://cybersecuritynews.com/claude-opus-5-reduces-prompt-injection-attack/",
          "note": "secondary source; comparison"
        }
      ],
      "matcher": {
        "all": [
          {
            "any": [
              {
                "all": [
                  {
                    "field": "model.id",
                    "op": "exists"
                  },
                  {
                    "field": "model.family",
                    "op": "in",
                    "value": [
                      "gpt-5"
                    ]
                  }
                ]
              },
              {
                "some": "models",
                "where": {
                  "field": "family",
                  "op": "in",
                  "value": [
                    "gpt-5"
                  ]
                }
              }
            ]
          },
          {
            "all": [
              {
                "some": "tools",
                "where": {
                  "field": "untrustedInput",
                  "op": "eq",
                  "value": true
                }
              },
              {
                "some": "tools",
                "where": {
                  "field": "sideEffect",
                  "op": "eq",
                  "value": true
                }
              }
            ]
          },
          {
            "field": "approval",
            "op": "in",
            "value": [
              "never",
              "allowlist"
            ]
          }
        ]
      },
      "fix": {
        "summary": "Set GPT-5.6 effort to Sol, keep approval on, and rerun the IPI curve.",
        "actions": [
          {
            "type": "reconfigure",
            "target": "agent.model.effort",
            "to": "sol",
            "why": "At k=15 R7 reports Sol 20.0%, Terra 30.4%, and Luna 43.9%."
          },
          {
            "type": "reconfigure",
            "target": "agent.approval",
            "to": "ask",
            "why": "Lower effort does not remove the need for a human boundary around side effects."
          }
        ]
      }
    }
  }
}