Decepticon ChatML injection enables arbitrary command execution

Decepticon fails to sanitize ChatML special-token literals in web crawl output, allowing attackers to forge operator commands and bypass agent guardrails when using open-source LLM backends. The vulnerability affects all 16 specialist agents in the framework.

Disclosed 24 September 2026 · Record updated 1 October 2026

Impact

Arbitrary command execution inside Decepticon sandbox environment; vulnerability spans all 16 specialist agents and affects BYOK deployments using open-source model providers

Our coverage

A mechanical spider crawls across a poisoned web, its threads glowing red as invisible puppet strings redirect its legs toward an open trapdoor leading underground.

Vulnerabilities

Decepticon red team agent can be hijacked by poisoned web pages

An advisory published on 24 September 2026 says PurpleAILAB's Decepticon passes raw crawl output to the model, letting attackers forge operator turns and run shell commands.

24 Sept 2026

Sources

github.comhttps://github.com/advisories/GHSA-g5f9-3xfg-p9mf