Executive brief
Decepticon is an autonomous red-team agent framework that sends web reconnaissance results to a language model for analysis. An attacker can embed ChatML special-token literals in a web page. When Decepticon's agents fetch and process that page, the special tokens are parsed as structural role markers, allowing the attacker to forge a fake "system" instruction that bypasses the framework's guardrails and triggers arbitrary command execution in the sandboxed Kali Linux environment.
Technical details
The vulnerability is a prompt-injection / role-boundary-forgery attack in the message-composition layer. Decepticon wraps untrusted external content (HTTP responses, tool output, web crawl results) into LangChain ToolMessage objects without sanitizing ChatML special-token literals such as `<|im_start|>system` and `<|im_end|>`. When these messages are tokenized by the underlying LLM (confirmed on Qwen2.5-7B-Instruct, Qwen3.5-397B-A17B, and other open-source models using ChatML or Qwen chat templates), the literal strings are parsed into structural role-delimiter token IDs, effectively injecting a new "system" role turn that the model treats as authoritative. This allows an attacker to command the agent to execute arbitrary shell commands in the Kali sandbox via the execute() method, bypassing intended agent guardrails. The attack requires attacker-controlled web content (e.g., a target web page or HTTP response) and is reliable against any BYOK (Bring Your Own Key) deployment using an open-source model provider whose tokenizer does not strip special-token literals. Hosted vendor APIs (OpenAI, Anthropic) are not affected because they filter special-token literals server-side. Remediation is application-layer: sanitize or escape ChatML, Llama, Gemma, and Mistral special-token literals in all external content before LLM composition.
Affected products
- PurpleAILAB Decepticon v1.1.4 and prior
Timeline
- 2026-09-24: disclosed: Vulnerability disclosed via GHSA-g5f9-3xfg-p9mf
- 2026-04-21: other: vLLM declined to fix special-token filtering, closed as out-of-scope for inference layer
- 2026-04-22: other: OpenClaw published analogous fix in commit 2514746b3261