Decepticon Red-Team Agent: ChatML Token Injection via Web Crawl Data Enables Sandbox Command Execution (CVE-2026-61732)

A newly disclosed GitHub Security Advisory (GHSA-g5f9-3xfg-p9mf, CVE-2026-61732, CVSS 10.0) details a role-boundary forgery vulnerability in PurpleAILAB/Decepticon, an autonomous AI-driven red-teaming agent framework. According to the advisory, Decepticon ingests web crawl and reconnaissance tool output (via tools like nmap, httpx, katana, ffuf) and composes it directly into LLM chat messages without stripping ChatML special-token literals such as <|im_start|> and <|im_end|>. Under Decepticon's BYOK (Bring Your Own Key) model, when the configured LLM backend is a self-hosted OpenAI-compatible endpoint (vLLM, SGLang, TGI, and similar), the tokenizer parses these literals as genuine structural role tokens rather than plain text. The reporters demonstrated that an attacker-controlled web page can therefore forge a new "system" or "user" turn that the model treats as authoritative, bypassing agent guardrails and resulting in arbitrary command execution inside Decepticon's Kali Linux sandbox. The advisory includes a paired A/B reproduction against Qwen3.5-397B-A17B and notes that vLLM declined to treat this as an inference-layer bug, placing remediation responsibility on the application layer.

Why It Matters

This affects all 16 specialist agents in Decepticon's shared LLM pipeline (recon, exploit, post-exploit, etc.), meaning a single unsanitized ingestion point compromises the entire agent roster. Per the advisory, exploitation requires a self-hosted/open-source tokenizer backend that preserves special-token IDs — hosted vendors like OpenAI, Anthropic, and DashScope reportedly strip these literals server-side and are not currently exploitable, though the advisory is explicit that this is vendor-side behavior, not an architectural guarantee. Organizations running Decepticon against untrusted or attacker-influenced targets (which is the framework's entire use case) with a self-hosted LLM backend face full command execution in the sandbox environment. A public PoC is already available, and the underlying primitive — special-token injection distinct from classic prompt injection — is likely applicable to other LLM-agent frameworks with similar tool-output-to-message pipelines.

What Defenders Should Do Now

• If you operate Decepticon (or any similar LLM-agent tool) with a self-hosted/BYOK OpenAI-compatible backend (vLLM, SGLang, Ollama, LM Studio, text-generation-webui), treat it as untrusted until patched, or restrict it to hosted-vendor backends that strip special tokens server-side.
• Audit any custom or internal agent frameworks for the same pattern: raw external content (web responses, tool output, file contents) composed into LLM messages without filtering chat-template special-token literals (ChatML, Llama-3.x header tokens, Gemma turn tokens, Mistral [INST]/[/INST], and the Unicode fullwidth-bar bypass variant noted in the advisory).
• Consider hunting for anomalous sandbox/tool-execution commands immediately following ingestion of external recon or crawl data, especially command sequences not attributable to the operator's stated task.
• Reference the advisory's suggested fix pattern — a sanitizer applied to untrusted content immediately before it is wrapped into LLM messages — as a starting point if building a mitigation for Decepticon or similar tooling.

This is fresh, developing intelligence published today with a public advisory and no vendor patch confirmed at time of writing; treat details as preliminary and monitor the advisory for updates. Full technical writeup, reproduction steps, and remediation guidance: GHSA-g5f9-3xfg-p9mf.