Decepticon Agent Framework Role-Boundary Forgery via ChatML Special-Token Literals

Decepticon (v1.1.16 and earlier) is vulnerable to a role-boundary forgery attack caused by the inclusion of unsanitized ChatML and other model-specific special-token literals in LLM message pipelines. The framework aggregates reconnaissance data from external tools - such as web crawlers, Nmap, and HTTP probes - into LLM context windows without neutralizing structural tokens.

When Decepticon is deployed using a BYOK model with OpenAI-compatible backends (e.g., vLLM, SGLang) that do not strip special-token literals server-side, an attacker can embed malicious literals like <|im_start|>system in a target web page. The model interprets these literals as structural boundaries, causing it to incorrectly transition from the "tool" role to a forged "system" turn. This bypasses agentic guardrails and allows the attacker to force the model to execute arbitrary shell commands within the underlying Kali Linux sandbox container used for exploit execution.

Attack Chain

1. Attacker hosts a malicious web page containing hidden ChatML literals (e.g., <|im_start|>system) and a command payload.
2. The Decepticon recon agent initiates a scan using a tool like katana against the attacker-controlled target.
3. The agent receives the HTTP response containing the malicious ChatML literals and stores the output as raw string data.
4. The Decepticon llm/factory.py logic composes an LLM message list, wrapping the raw tool output without performing sanitization.
5. The framework transmits the unsanitized messages to the LLM backend via the ChatOpenAI subclass ainvoke() method.
6. The backend tokenizer translates the embedded ChatML literals into structural role-boundary IDs, causing the model to treat the attacker payload as an authoritative system instruction.
7. The agent's model logic follows the forged instruction to call backends/http_sandbox.py with an arbitrary command.
8. The Kali Linux sandbox executes the injected shell command, resulting in complete container compromise.

Impact

Successful exploitation allows for arbitrary code execution (ACE) within the isolated Kali Linux sandbox container. While the sandbox provides a level of isolation, the agent's architecture gives it access to reconnaissance data and potentially other internal network resources reachable from the container environment. The vulnerability impacts all 16 specialist agents within the Decepticon framework and is confirmed against common model providers like vLLM and SGLang.

Recommendation

1. Patch immediately by upgrading decepticon, decepticon-core, and decepticon-sdk to a version that implements literal filtering.
2. Implement an application-layer sanitization step in the LLM message composition pipeline that strips or escapes known special-token literals (e.g., <|im_start|, <|im_end|, <|begin_of_text|>) before ingestion into the context window.
3. Reference the remediation logic provided in OpenClaw commit 2514746b3261 as a verified mitigation pattern.
4. Perform regression testing on the tokenizer's chat template output to ensure special-token literals are correctly neutralized by the application logic before reaching the LLM inference layer.