Decepticon Sdk
Monthly
Decepticon versions prior to 1.1.17 fail to neutralize ChatML-style special-token literals (e.g. <|im_start|>, <|eot_id|>, <start_of_turn>, [INST], <<SYS>>) embedded in web crawl results returned by agent reconnaissance, so an attacker who plants such a string on a crawled page can forge an authoritative operator turn that the model acts on, bypassing Decepticon's agent guardrails and achieving arbitrary command execution inside the Kali Linux sandbox. Exploitation is unauthenticated (PR:N) but conditional: it requires the BYOK deployment model with a self-hosted or OpenAI-compatible backend (vLLM, SGLang, TGI, Ollama, LM Studio, text-generation-webui) whose tokenizer preserves special-token IDs, and the operator must actually crawl attacker-controlled or attacker-compromised content - both normal for a red-team tool. Deployments using hosted providers such as OpenAI or Anthropic are not vulnerable because those strip special tokens server-side; no public exploit code has been identified at time of analysis, and the advisory ships with a vendor fix in 1.1.17.
Decepticon versions prior to 1.1.17 fail to neutralize ChatML-style special-token literals (e.g. <|im_start|>, <|eot_id|>, <start_of_turn>, [INST], <<SYS>>) embedded in web crawl results returned by agent reconnaissance, so an attacker who plants such a string on a crawled page can forge an authoritative operator turn that the model acts on, bypassing Decepticon's agent guardrails and achieving arbitrary command execution inside the Kali Linux sandbox. Exploitation is unauthenticated (PR:N) but conditional: it requires the BYOK deployment model with a self-hosted or OpenAI-compatible backend (vLLM, SGLang, TGI, Ollama, LM Studio, text-generation-webui) whose tokenizer preserves special-token IDs, and the operator must actually crawl attacker-controlled or attacker-compromised content - both normal for a red-team tool. Deployments using hosted providers such as OpenAI or Anthropic are not vulnerable because those strip special tokens server-side; no public exploit code has been identified at time of analysis, and the advisory ships with a vendor fix in 1.1.17.