Decepticon red team agent can be hijacked by poisoned web pages

A security advisory published on 24 September 2026 says PurpleAILAB's Decepticon, an autonomous red team agent framework, can be tricked into running attacker-chosen shell commands by text planted in a target web page. The flaw is tracked as CVE-2026-61732 and GHSA-g5f9-3xfg-p9mf, and affects the pip packages decepticon-core, decepticon and decepticon-sdk. Version 1.1.4 is confirmed vulnerable, and the advisory says the problem is not release-specific.

The cause is a missing sanitisation step. According to the advisory, Decepticon wraps web crawl results — the output of its own reconnaissance tools pointed at target services — into messages sent to the language model without neutralising ChatML special-token literals. ChatML is the markup many models use to separate the system, user and tool parts of a conversation. Strings such as <|im_start|>system are not treated as ordinary text by some tokenizers; they are converted into the structural tokens that mark a role boundary. An attacker who plants such a string on a web page can therefore forge what looks to the model like a new, authoritative operator instruction.

The advisory says that forged turn bypasses Decepticon's agent guardrails and leads to arbitrary command execution inside the Kali Linux sandbox that the framework uses. It traces the path through three layers: the reconnaissance agent, which captures raw tool output from nmap, httpx, dnsx, katana, masscan, ffuf and shell tools; the LLM message composition code in llm/factory.py, where unsanitised tool output is passed straight to the LangChain client; and the sandbox backend, whose execute() method dispatches commands to a container with full Kali shell access. No filter or escape step exists between tool output collection and model invocation, the advisory says. All 16 specialist agents in the framework — covering reconnaissance, exploitation and post-exploitation — share the same context pipeline, so the whole roster is affected.

Exploitability depends on the model backend. Decepticon uses a bring-your-own-key model, where users point the tool at any OpenAI-compatible endpoint. The advisory says most open-source and self-deployed providers, including vLLM, SGLang, Ollama, LM Studio and text-generation-webui, do not filter special-token literals from user content in their default settings. Vulnerability is confirmed upstream on vLLM, SGLang and TGI, and on the Qwen3.5-397B-A17B model. Hosted vendors including OpenAI, Anthropic and DashScope strip the literals server-side, so the advisory says the issue is not currently exploitable against them — but it stresses that this is vendor behaviour, not a property of Decepticon itself.

That leaves the fix with the application. The advisory notes that vLLM declined to address the issue on 21 April 2026, closing it as out of scope for the inference layer. It points to OpenClaw, which completed an analogous fix a day later, on 22 April 2026, in commit 2514746b3261 — around 30 lines, applying a sanitiser just before tool output is wrapped. The advisory describes that as evidence that application-layer mitigation is feasible, and says the durable control is filtering or escaping special-token literals in the agent framework.

The advisory includes a reproduction that needs no Decepticon instance. It loads a Qwen tokenizer and feeds it a payload disguised as meeting notes, which closes the tool response and opens a fake system turn instructing the agent to create a marker file, adding that no user confirmation is needed.