Decepticon, an autonomous hacking agent used by red teams, improperly neutralizes special ChatML token literals in web crawl outputs before embedding them into LLM messages. Under the BYOK deployment model, users supply their own LLM credentials to OpenAI-compatible endpoints, many of which do not filter these special tokens by default. An attacker can exploit this by planting malicious strings in target web pages that are parsed as authoritative commands by the model, resulting in arbitrary command execution inside the Kali Linux sandbox. This vulnerability is tracked as CVE-2026-61732 and is patched in version 1.1.17.

Successful exploitation allows an attacker to bypass Decepticon's agent guardrails and execute arbitrary commands within the Kali Linux sandbox environment. This leads to full compromise of the sandboxed environment, potentially enabling further malicious activity or data compromise.

Upgrade Decepticon to version 1.1.17 or later, which includes a patch that properly neutralizes ChatML special-token literals in web crawl results. Users should apply this official fix to prevent exploitation. No other mitigations are indicated by the vendor advisory.