CVE-2026-61732: Decepticon: ChatML token injection yields sandbox RCE

Published September 24, 2026

CISO Take

Decepticon, an autonomous red-team hacking agent, wraps web crawl results into LLM messages without neutralizing ChatML special-token literals, so a string planted on any target web page can forge an operator turn and make the agent run arbitrary commands inside its Kali sandbox. The CVSS is 10.0 (network, no privileges, no user interaction, scope changed), but EPSS is only 0.01221 (top 32%), there is no public exploit or Nuclei template, and it is not in CISA KEV, although CISA SSVC rates it ATTEND. Exposure is concentrated in teams running Decepticon against untrusted or attacker-influenced targets with self-hosted OpenAI-compatible backends (vLLM, SGLang, Ollama, LM Studio), where special tokens are not filtered by default. Upgrade decepticon, decepticon-core and decepticon-sdk to 1.1.17 or later, and until then run the agent only against trusted scope, on an isolated network, with no credentials or pivot access reachable from the sandbox.

Sources:NVDEPSSGitHub AdvisoryATLASCISA SSVC

What is the risk?

Severity is critical on paper (CVSS 3.1: 10.0), but real-world likelihood is moderate and conditional. An attacker needs no privileges or user interaction, only the ability to put text on a page the agent crawls. The attack depends on the BYOK model backend not stripping special-token literals, which is the default for most self-hosted inference servers. EPSS is low (0.01221, top 32%), there is no public exploit, no Nuclei template and no KEV listing, and SSVC says ATTEND. The scope-changed rating reflects that code execution happens in the agent's sandbox, which typically holds engagement tooling, API keys and network reach into the tested environment. Impact is highest for offensive-security teams and anyone who points the agent at internet-facing or hostile targets. The package has 95 downstream dependents and 134 other CVEs, which points to a weak overall security posture.

How does the attack unfold?

Payload Planting

Attacker places text containing ChatML special-token literals on a web page the agent is likely to crawl.

AML.T0099

Ingestion

Decepticon crawls the page and wraps the result into an LLM message without neutralizing the special tokens.

AML.T0051.001

Role Forgery

The self-hosted inference server tokenizes the literals into role-boundary IDs, so the model treats the injected text as an authoritative operator turn and bypasses guardrails.

AML.T0054

Command Execution

The agent runs attacker-chosen commands in the Kali sandbox, exposing API keys and engagement data and enabling pivoting.

AML.T0050

Payload Planting

Attacker places text containing ChatML special-token literals on a web page the agent is likely to crawl.

AML.T0099

Ingestion

Decepticon crawls the page and wraps the result into an LLM message without neutralizing the special tokens.

AML.T0051.001

Role Forgery

The self-hosted inference server tokenizes the literals into role-boundary IDs, so the model treats the injected text as an authoritative operator turn and bypasses guardrails.

AML.T0054

Command Execution

The agent runs attacker-chosen commands in the Kali sandbox, exposing API keys and engagement data and enabling pivoting.

AML.T0050

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
vLLM	pip	<= 1.1.16	`1.1.17`
96.5K93 dependentsPushed 5d ago26% patched~37d to patchFull package profile →
vLLM	pip	<= 1.1.16	`1.1.17`
96.5K93 dependentsPushed 5d ago26% patched~37d to patchFull package profile →
vLLM	pip	<= 1.1.16	`1.1.17`
96.5K93 dependentsPushed 5d ago26% patched~37d to patchFull package profile →
Decepticon	—	—	No patch
decepticon-core	—	—	No patch
decepticon-sdk	—	—	No patch

How severe is it?

CVSS 3.1

10.0 / 10

EPSS

1.5%

chance of exploitation in 30 days

Higher than 74% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

○CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SChanged

CHigh

IHigh

AHigh

What should I do?

7 steps

Upgrade decepticon, decepticon-core and decepticon-sdk to 1.1.17 or later (fix in commit 79ee2aa, PR #715).
Until patched, restrict the agent to trusted, in-scope targets and avoid crawling hostile or user-generated content.
Run the sandbox with least privilege: no host mounts, egress filtering, and no long-lived secrets or cloud credentials reachable from it.
Where possible, configure the model server or gateway to reject or escape special-token literals in user content (for example ChatML tokens such as <|im_start|> and <|im_end|>).
Use dedicated, rate- and spend-limited LLM API keys for the agent and rotate them if it has touched untrusted targets.
Detect by searching agent logs, tool outputs and crawled content for special-token literals, and by monitoring the sandbox for unexpected process execution or outbound connections.
Add a human approval step for command execution when running on untrusted targets.

What does CISA's SSVC say?

DecisionAttend

Exploitationpoc

AutomatableYes

Technical Impacttotal

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Prompt InjectionCode ExecutionAgentFrameworkInferenceAML.T0050- Command and Scripting Interpreter AML.T0051.001- Indirect AML.T0053- AI Agent Tool Invocation AML.T0054- LLM Jailbreak AML.T0069.000- Special Character Sets AML.T0099- AI Agent Tool Data Poisoning

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.4-AI system verification and validation

NIST AI RMF

MEASURE 2.7-AI system security and resilience are evaluated

OWASP LLM Top 10

LLM01-Prompt InjectionLLM05-Improper Output HandlingLLM06-Excessive Agency

Frequently Asked Questions

What is CVE-2026-61732?

Is CVE-2026-61732 actively exploited?

No confirmed active exploitation of CVE-2026-61732 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-61732?

1. Upgrade decepticon, decepticon-core and decepticon-sdk to 1.1.17 or later (fix in commit 79ee2aa, PR #715). 2. Until patched, restrict the agent to trusted, in-scope targets and avoid crawling hostile or user-generated content. 3. Run the sandbox with least privilege: no host mounts, egress filtering, and no long-lived secrets or cloud credentials reachable from it. 4. Where possible, configure the model server or gateway to reject or escape special-token literals in user content (for example ChatML tokens such as <|im_start|> and <|im_end|>). 5. Use dedicated, rate- and spend-limited LLM API keys for the agent and rotate them if it has touched untrusted targets. 6. Detect by searching agent logs, tool outputs and crawled content for special-token literals, and by monitoring the sandbox for unexpected process execution or outbound connections. 7. Add a human approval step for command execution when running on untrusted targets.

What systems are affected by CVE-2026-61732?

This vulnerability affects the following AI/ML architecture patterns: agent frameworks, autonomous offensive-security agents, LLM inference backends (self-hosted, OpenAI-compatible), BYOK deployments, tool-using LLM pipelines.

What is the CVSS score for CVE-2026-61732?

CVE-2026-61732 has a CVSS v3.1 base score of 10.0 (CRITICAL). The EPSS exploitation probability is 1.47%.

What is the AI security impact?

Affected AI Architectures

agent frameworksautonomous offensive-security agentsLLM inference backends (self-hosted, OpenAI-compatible)BYOK deploymentstool-using LLM pipelines

MITRE ATLAS Techniques

AML.T0050Command and Scripting Interpreter

AML.T0051.001Indirect

AML.T0053AI Agent Tool Invocation

AML.T0054LLM Jailbreak

AML.T0069.000Special Character Sets

AML.T0099AI Agent Tool Data Poisoning

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.4

NIST AI RMF: MEASURE 2.7

OWASP LLM Top 10: LLM01, LLM05, LLM06

What are the technical details?

Original Advisory

Decepticon is an autonomous hacking agent for red teams. Versions prior to 1.1.17 wrap web crawl results — the output of agent reconnaissance against target services — into LLM messages without neutralizing ChatML special-token literals. Under the BYOK (Bring Your Own Key) deployment model, users configure their own LLM credentials to any OpenAI-compatible endpoint. Most open-source and self-deployed model providers (vLLM, SGLang, Ollama, LM Studio, text-generation-webui, etc.) do not filter special-token literals from user content in their default configurations. Those literals are parsed into structural role-boundary token IDs, meaning an attacker string planted in a target web page forges a new operator turn the model treats as authoritative, bypassing Decepticon's agent guardrails and resulting in arbitrary command execution inside the Kali Linux sandbox. Version 1.1.17 patches the issue.

Exploitation Scenario

An attacker anticipates that a security team or a rival will point an autonomous agent such as Decepticon at their infrastructure, or lures it there. They host a page containing text with ChatML literals that close the current message and open a new operator turn instructing the agent to run a shell command. When the agent crawls the page during reconnaissance, the result is wrapped into an LLM message unsanitized, and a self-hosted vLLM or Ollama backend tokenizes the literals into real role-boundary token IDs. The model treats the injected turn as authoritative, ignores the guardrails and executes the command in the Kali sandbox. The attacker then exfiltrates the user's LLM API key and engagement data, and uses the sandbox's network position to pivot into the operator's or the client's environment.

Weaknesses (CWE)

CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Primary CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream Component

CWE-74 — Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'): The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

[Requirements] Programming languages and supporting technologies might be chosen which are not subject to these issues.
[Implementation] Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.

Source: MITRE CWE corpus.