{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/purpleailab/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[{"cvss":10,"id":"CVE-2026-61732"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Decepticon (\u003c= 1.1.16)","decepticon-core (\u003c= 1.1.16)","decepticon-sdk (\u003c= 1.1.16)"],"_cs_severities":["critical"],"_cs_tags":["agent-security","llm-security","prompt-injection","rce"],"_cs_type":"advisory","_cs_vendors":["PurpleAILAB"],"content_html":"\u003cp\u003eDecepticon (v1.1.16 and earlier) is vulnerable to a role-boundary forgery attack caused by the inclusion of unsanitized ChatML and other model-specific special-token literals in LLM message pipelines. The framework aggregates reconnaissance data from external tools - such as web crawlers, Nmap, and HTTP probes - into LLM context windows without neutralizing structural tokens.\u003c/p\u003e\n\u003cp\u003eWhen Decepticon is deployed using a BYOK model with OpenAI-compatible backends (e.g., vLLM, SGLang) that do not strip special-token literals server-side, an attacker can embed malicious literals like \u003ccode\u003e\u0026lt;|im_start|\u0026gt;system\u003c/code\u003e in a target web page. The model interprets these literals as structural boundaries, causing it to incorrectly transition from the \u0026quot;tool\u0026quot; role to a forged \u0026quot;system\u0026quot; turn. This bypasses agentic guardrails and allows the attacker to force the model to execute arbitrary shell commands within the underlying Kali Linux sandbox container used for exploit execution.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker hosts a malicious web page containing hidden ChatML literals (e.g., \u003ccode\u003e\u0026lt;|im_start|\u0026gt;system\u003c/code\u003e) and a command payload.\u003c/li\u003e\n\u003cli\u003eThe Decepticon recon agent initiates a scan using a tool like \u003ccode\u003ekatana\u003c/code\u003e against the attacker-controlled target.\u003c/li\u003e\n\u003cli\u003eThe agent receives the HTTP response containing the malicious ChatML literals and stores the output as raw string data.\u003c/li\u003e\n\u003cli\u003eThe Decepticon \u003ccode\u003ellm/factory.py\u003c/code\u003e logic composes an LLM message list, wrapping the raw tool output without performing sanitization.\u003c/li\u003e\n\u003cli\u003eThe framework transmits the unsanitized messages to the LLM backend via the \u003ccode\u003eChatOpenAI\u003c/code\u003e subclass \u003ccode\u003eainvoke()\u003c/code\u003e method.\u003c/li\u003e\n\u003cli\u003eThe backend tokenizer translates the embedded ChatML literals into structural role-boundary IDs, causing the model to treat the attacker payload as an authoritative system instruction.\u003c/li\u003e\n\u003cli\u003eThe agent's model logic follows the forged instruction to call \u003ccode\u003ebackends/http_sandbox.py\u003c/code\u003e with an arbitrary command.\u003c/li\u003e\n\u003cli\u003eThe Kali Linux sandbox executes the injected shell command, resulting in complete container compromise.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for arbitrary code execution (ACE) within the isolated Kali Linux sandbox container. While the sandbox provides a level of isolation, the agent's architecture gives it access to reconnaissance data and potentially other internal network resources reachable from the container environment. The vulnerability impacts all 16 specialist agents within the Decepticon framework and is confirmed against common model providers like vLLM and SGLang.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003ePatch immediately by upgrading \u003ccode\u003edecepticon\u003c/code\u003e, \u003ccode\u003edecepticon-core\u003c/code\u003e, and \u003ccode\u003edecepticon-sdk\u003c/code\u003e to a version that implements literal filtering.\u003c/li\u003e\n\u003cli\u003eImplement an application-layer sanitization step in the LLM message composition pipeline that strips or escapes known special-token literals (e.g., \u003ccode\u003e\u0026lt;|im_start|\u003c/code\u003e, \u003ccode\u003e\u0026lt;|im_end|\u003c/code\u003e, \u003ccode\u003e\u0026lt;|begin_of_text|\u0026gt;\u003c/code\u003e) before ingestion into the context window.\u003c/li\u003e\n\u003cli\u003eReference the remediation logic provided in OpenClaw commit \u003ccode\u003e2514746b3261\u003c/code\u003e as a verified mitigation pattern.\u003c/li\u003e\n\u003cli\u003ePerform regression testing on the tokenizer's chat template output to ensure special-token literals are correctly neutralized by the application logic before reaching the LLM inference layer.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-09-24T20:04:18Z","date_published":"2026-09-24T20:04:18Z","id":"https://feed.craftedsignal.io/briefs/2026-09-decepticon-role-boundary-forgery/","summary":"The Decepticon agent framework fails to sanitize model-specific special-token literals in external reconnaissance data, allowing attackers to forge system-level instructions and execute arbitrary commands in the agent's Kali Linux sandbox.","title":"Decepticon Agent Framework Role-Boundary Forgery via ChatML Special-Token Literals","url":"https://feed.craftedsignal.io/briefs/2026-09-decepticon-role-boundary-forgery/"}],"language":"en","title":"CraftedSignal Threat Feed - PurpleAILAB","version":"https://jsonfeed.org/version/1.1"}