CVE-2026-61732criticalPrompt injection2026-09-24

CVE-2026-61732: web pages can forge operator turns in the Decepticon hacking agent with ChatML tokens and run commands, upgrade to 1.1.17

Decepticon, an autonomous red-team hacking agent, put web crawl output into LLM messages without removing ChatML special-token literals before 1.1.17. With a self-hosted OpenAI-compatible backend that keeps those tokens, text planted on a target page can forge a new operator turn, bypass the agent's guardrails and run commands in its Kali sandbox.

01.

What it is

Decepticon wraps the results of web reconnaissance into LLM messages without neutralizing ChatML special-token literals.

In the bring-your-own-key setup, many self-hosted model servers (the advisory names vLLM, SGLang, Ollama, LM Studio and text-generation-webui) parse those literals into real role-boundary tokens by default.

An attacker string on a target web page can then open a fake operator turn that the model treats as authoritative, bypassing Decepticon's guardrails and leading to arbitrary command execution inside the Kali Linux sandbox.

The advisory says hosted vendors such as OpenAI, Anthropic and DashScope strip these literals server-side, so they aren't currently exploitable, but that protection comes from the vendor, not from Decepticon.

02.

How to check

Check your Decepticon version: the decepticon, decepticon-core and decepticon-sdk packages up to 1.1.16 are affected.
Check which model endpoint you configured. A self-hosted OpenAI-compatible server (vLLM, SGLang, TGI, Ollama and similar) is the risky case.

03.

How to fix

Upgrade decepticon, decepticon-core and decepticon-sdk to 1.1.17 or later.
Until then, don't point the agent at untrusted targets while it uses a self-hosted backend that keeps special tokens.

pip install -U 'decepticon>=1.1.17' 'decepticon-core>=1.1.17' 'decepticon-sdk>=1.1.17'

04.

Sources

More advisories for this tool