What happened
GitHub advisory published 24 Sept 2026: Decepticon (< 1.1.17) fails to neutralize ChatML special-token literals in web-crawl output, allowing a planted string on a target page to forge a new system/operator turn that bypasses agent guardrails and enables arbitrary command execution in the sandbox - a universal risk to BYOK agent deployments using unfiltered model providers.
Why it matters
Demonstrates the injection-of-instruction-boundaries attack (ChatML special tokens) as a concrete, working RCE in an autonomous agent - the same class of flaw that threatens any agent that feeds untrusted web/tool output back to a self-hosted, unfiltered LLM backend.
Attack vector
Web crawl results from agent reconnaissance are wrapped into LLM messages without neutralizing ChatML special-token literals. Because many OpenAI-compatible providers (vLLM, SGLang, Ollama, LM Studio) parse those literals into role-boundary tokens, an attacker string planted on a target web page forges a new authoritative 'operator' turn, bypassing Decepticon's guardrails and yielding arbitrary command execution inside the Kali Linux sandbox.
Affected systems
BitterSecurity Decepticon / decepticon-core / decepticon-sdk < 1.1.17
Mitigation
Upgrade Decepticon to >= 1.1.17; defenders running autonomous agents should ensure their model provider neutralizes ChatML/instruction-boundary special tokens in untrusted content.