Critical, CVSS 10.0PyPIAmendedPublished
Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context
CVE-2026-61732 · GHSA-g5f9-3xfg-p9mf
- Affected
- PyPI decepticon-core <= 1.1.16
- Fixed in
- 1.1.17· Vendor fix available
- Issue
- Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of…
Recommended action: Upgrade to 1.1.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.