CVE-2026-61732

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.

Summary

Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.

The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of scope for the inference layer." Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit 2514746b3261 (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.

Applicability

Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed upstream.

Not currently exploitable against hosted vendors (OpenAI, Anthropic, DashScope) who strip special-token literals server-side. However, this immunity is vendor-side behavior, not an architectural guarantee of Decepticon. The durable control is application-layer literal filtering or escaping.

Affected

• PurpleAILAB/Decepticon v1.1.4 (confirmed); not release-specific.
• Backend: any model provider whose tokenizer preserves special-token IDs — confirmed on Qwen3.5-397B-A17B.
• All 16 specialist agents share the same LLM context pipeline — the vulnerability spans the entire agent roster (recon, exploit, post-exploit, etc.).
• Any chat template with ChatML / Qwen role delimiters.

Affected code paths

The vulnerability spans three layers — external data ingestion, LLM message composition, and command execution. All 16 specialist agents share this pipeline.

1. Reconnaissance & external data ingestion — agents/standard/recon.py

The recon agent collects target intelligence via a suite of tools (nmap, httpx, dnsx, masscan, katana, ffuf, etc.). All tool outputs — including HTTP responses from target web servers — are captured as raw string content and returned to the agent loop:

# recon.py:85-100 — tool registration for external data collection
kg_ingest_nmap_xml,      # Nmap scan results
kg_ingest_httpx_jsonl,   # HTTP probe responses
kg_ingest_dnsx,          # DNS enumeration output
kg_ingest_katana,        # Web crawler output
kg_ingest_masscan,       # Mass port scan results
kg_ingest_ffuf,          # Directory brute-force output
*BASH_TOOLS,             # Arbitrary shell command execution

2. LLM message composition — llm/factory.py

LangChain's ChatOpenAI subclass wraps every LLM call through ainvoke(). The message list — containing system prompt, conversation history, and raw, unsanitized tool outputs — is passed directly to the LangChain LLM without any special-token stripping step:

# factory.py:733-742 — LLM invocation with raw tool output
async def ainvoke(self, *args, **kwargs):
    try:
        return await call_with_timeout(
            super().ainvoke(*args, **kwargs),
            _resolve_llm_timeout_seconds(),
        )
    except LLMTimeoutError:
        raise

Tool outputs returned to the agent are formatted as LangChain ToolMessage objects (role "tool"). When these messages are sent to the LLM in subsequent turns, ChatML literals…

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.

Summary

Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.

The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of scope for the inference layer." Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit 2514746b3261 (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.

Applicability

Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed upstream.

Not currently exploitable against hosted vendors (OpenAI, Anthropic, DashScope) who strip special-token literals server-side. However, this immunity is vendor-side behavior, not an architectural guarantee of Decepticon. The durable control is application-layer literal filtering or escaping.

Affected

• PurpleAILAB/Decepticon v1.1.4 (confirmed); not release-specific.
• Backend: any model provider whose tokenizer preserves special-token IDs — confirmed on Qwen3.5-397B-A17B.
• All 16 specialist agents share the same LLM context pipeline — the vulnerability spans the entire agent roster (recon, exploit, post-exploit, etc.).
• Any chat template with ChatML / Qwen role delimiters.

Affected code paths

The vulnerability spans three layers — external data ingestion, LLM message composition, and command execution. All 16 specialist agents share this pipeline.

1. Reconnaissance & external data ingestion — agents/standard/recon.py

The recon agent collects target intelligence via a suite of tools (nmap, httpx, dnsx, masscan, katana, ffuf, etc.). All tool outputs — including HTTP responses from target web servers — are captured as raw string content and returned to the agent loop:

# recon.py:85-100 — tool registration for external data collection
kg_ingest_nmap_xml,      # Nmap scan results
kg_ingest_httpx_jsonl,   # HTTP probe responses
kg_ingest_dnsx,          # DNS enumeration output
kg_ingest_katana,        # Web crawler output
kg_ingest_masscan,       # Mass port scan results
kg_ingest_ffuf,          # Directory brute-force output
*BASH_TOOLS,             # Arbitrary shell command execution

2. LLM message composition — llm/factory.py

LangChain's ChatOpenAI subclass wraps every LLM call through ainvoke(). The message list — containing system prompt, conversation history, and raw, unsanitized tool outputs — is passed directly to the LangChain LLM without any special-token stripping step:

# factory.py:733-742 — LLM invocation with raw tool output
async def ainvoke(self, *args, **kwargs):
    try:
        return await call_with_timeout(
            super().ainvoke(*args, **kwargs),
            _resolve_llm_timeout_seconds(),
        )
    except LLMTimeoutError:
        raise

Tool outputs returned to the agent are formatted as LangChain ToolMessage objects (role "tool"). When these messages are sent to the LLM in subsequent turns, ChatML literals…

Summary

Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.

The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of scope for the inference layer." Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit 2514746b3261 (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.

Applicability

Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed upstream.

Not currently exploitable against hosted vendors (OpenAI, Anthropic, DashScope) who strip special-token literals server-side. However, this immunity is vendor-side behavior, not an architectural guarantee of Decepticon. The durable control is application-layer literal filtering or escaping.

Affected

• PurpleAILAB/Decepticon v1.1.4 (confirmed); not release-specific.
• Backend: any model provider whose tokenizer preserves special-token IDs — confirmed on Qwen3.5-397B-A17B.
• All 16 specialist agents share the same LLM context pipeline — the vulnerability spans the entire agent roster (recon, exploit, post-exploit, etc.).
• Any chat template with ChatML / Qwen role delimiters.

Affected code paths

The vulnerability spans three layers — external data ingestion, LLM message composition, and command execution. All 16 specialist agents share this pipeline.

1. Reconnaissance & external data ingestion — agents/standard/recon.py

The recon agent collects target intelligence via a suite of tools (nmap, httpx, dnsx, masscan, katana, ffuf, etc.). All tool outputs — including HTTP responses from target web servers — are captured as raw string content and returned to the agent loop:

# recon.py:85-100 — tool registration for external data collection
kg_ingest_nmap_xml,      # Nmap scan results
kg_ingest_httpx_jsonl,   # HTTP probe responses
kg_ingest_dnsx,          # DNS enumeration output
kg_ingest_katana,        # Web crawler output
kg_ingest_masscan,       # Mass port scan results
kg_ingest_ffuf,          # Directory brute-force output
*BASH_TOOLS,             # Arbitrary shell command execution

2. LLM message composition — llm/factory.py

LangChain's ChatOpenAI subclass wraps every LLM call through ainvoke(). The message list — containing system prompt, conversation history, and raw, unsanitized tool outputs — is passed directly to the LangChain LLM without any special-token stripping step:

# factory.py:733-742 — LLM invocation with raw tool output
async def ainvoke(self, *args, **kwargs):
    try:
        return await call_with_timeout(
            super().ainvoke(*args, **kwargs),
            _resolve_llm_timeout_seconds(),
        )
    except LLMTimeoutError:
        raise

Tool outputs returned to the agent are formatted as LangChain ToolMessage objects (role "tool"). When these messages are sent to the LLM in subsequent turns, ChatML literals…

Summary

Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.

The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of scope for the inference layer." Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit 2514746b3261 (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.

Applicability

Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed upstream.

Not currently exploitable against hosted vendors (OpenAI, Anthropic, DashScope) who strip special-token literals server-side. However, this immunity is vendor-side behavior, not an architectural guarantee of Decepticon. The durable control is application-layer literal filtering or escaping.

Affected

• PurpleAILAB/Decepticon v1.1.4 (confirmed); not release-specific.
• Backend: any model provider whose tokenizer preserves special-token IDs — confirmed on Qwen3.5-397B-A17B.
• All 16 specialist agents share the same LLM context pipeline — the vulnerability spans the entire agent roster (recon, exploit, post-exploit, etc.).
• Any chat template with ChatML / Qwen role delimiters.

Affected code paths

The vulnerability spans three layers — external data ingestion, LLM message composition, and command execution. All 16 specialist agents share this pipeline.

1. Reconnaissance & external data ingestion — agents/standard/recon.py

The recon agent collects target intelligence via a suite of tools (nmap, httpx, dnsx, masscan, katana, ffuf, etc.). All tool outputs — including HTTP responses from target web servers — are captured as raw string content and returned to the agent loop:

# recon.py:85-100 — tool registration for external data collection
kg_ingest_nmap_xml,      # Nmap scan results
kg_ingest_httpx_jsonl,   # HTTP probe responses
kg_ingest_dnsx,          # DNS enumeration output
kg_ingest_katana,        # Web crawler output
kg_ingest_masscan,       # Mass port scan results
kg_ingest_ffuf,          # Directory brute-force output
*BASH_TOOLS,             # Arbitrary shell command execution

2. LLM message composition — llm/factory.py

LangChain's ChatOpenAI subclass wraps every LLM call through ainvoke(). The message list — containing system prompt, conversation history, and raw, unsanitized tool outputs — is passed directly to the LangChain LLM without any special-token stripping step:

# factory.py:733-742 — LLM invocation with raw tool output
async def ainvoke(self, *args, **kwargs):
    try:
        return await call_with_timeout(
            super().ainvoke(*args, **kwargs),
            _resolve_llm_timeout_seconds(),
        )
    except LLMTimeoutError:
        raise

Tool outputs returned to the agent are formatted as LangChain ToolMessage objects (role "tool"). When these messages are sent to the LLM in subsequent turns, ChatML literals…

Summary

Decepticon wraps web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox.

The vast majority of open-source and self-deployed model providers do not filter special-token literals. vLLM explicitly declined to fix this issue on 2026-04-21, closing it as "out of scope for the inference layer." Fix responsibility therefore falls squarely on the Agent application layer. OpenClaw completed an analogous fix on 2026-04-22 via commit 2514746b3261 (~30 lines, sanitizer applied just before tool-output wrapping), demonstrating the feasibility of application-layer mitigation.

Applicability

Confirmed vulnerable when Decepticon is configured with a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs — vLLM / SGLang / TGI confirmed upstream.

Not currently exploitable against hosted vendors (OpenAI, Anthropic, DashScope) who strip special-token literals server-side. However, this immunity is vendor-side behavior, not an architectural guarantee of Decepticon. The durable control is application-layer literal filtering or escaping.

Affected

• PurpleAILAB/Decepticon v1.1.4 (confirmed); not release-specific.
• Backend: any model provider whose tokenizer preserves special-token IDs — confirmed on Qwen3.5-397B-A17B.
• All 16 specialist agents share the same LLM context pipeline — the vulnerability spans the entire agent roster (recon, exploit, post-exploit, etc.).
• Any chat template with ChatML / Qwen role delimiters.

Affected code paths

The vulnerability spans three layers — external data ingestion, LLM message composition, and command execution. All 16 specialist agents share this pipeline.

1. Reconnaissance & external data ingestion — agents/standard/recon.py

The recon agent collects target intelligence via a suite of tools (nmap, httpx, dnsx, masscan, katana, ffuf, etc.). All tool outputs — including HTTP responses from target web servers — are captured as raw string content and returned to the agent loop:

# recon.py:85-100 — tool registration for external data collection
kg_ingest_nmap_xml,      # Nmap scan results
kg_ingest_httpx_jsonl,   # HTTP probe responses
kg_ingest_dnsx,          # DNS enumeration output
kg_ingest_katana,        # Web crawler output
kg_ingest_masscan,       # Mass port scan results
kg_ingest_ffuf,          # Directory brute-force output
*BASH_TOOLS,             # Arbitrary shell command execution

2. LLM message composition — llm/factory.py

LangChain's ChatOpenAI subclass wraps every LLM call through ainvoke(). The message list — containing system prompt, conversation history, and raw, unsanitized tool outputs — is passed directly to the LangChain LLM without any special-token stripping step:

# factory.py:733-742 — LLM invocation with raw tool output
async def ainvoke(self, *args, **kwargs):
    try:
        return await call_with_timeout(
            super().ainvoke(*args, **kwargs),
            _resolve_llm_timeout_seconds(),
        )
    except LLMTimeoutError:
        raise

Tool outputs returned to the agent are formatted as LangChain ToolMessage objects (role "tool"). When these messages are sent to the LLM in subsequent turns, ChatML literals…