GHSA-g5f9-3xfg-p9mf: Decepticon: Role-boundary forgery via ChatML special-token literals in web crawl output composed into LLM context

Summary

Decepticon composes web crawl output into LLM messages without neutralizing ChatML special-token literals, so a string planted in a target web page can forge a new operator turn that the model treats as authoritative. Under a BYOK OpenAI-compatible backend whose tokenizer preserves special-token IDs (confirmed with vLLM, SGLang and TGI), this bypasses agent guardrails and enables arbitrary command execution in the Kali Linux sandbox. Confirmed in v1.1.4 across all 16 specialist agents.

Mitigation

The source does not state a fix yet. Check the original advisory for updates.

Related items

• LowHelp defend against memory poisoning in Amazon Bedrock AgentCore with multi-layer write validationSimilar attack · AWS Security Blog
• MediumTop MCP security resources — November 2026Similar attack · Adversa AI Blog
• LowCVE-2026-123498: Vikunja veans prompt injection through project titles and task contentSimilar attack · NVD/CVE Database
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• MediumCVE-2026-124028: mistral.rs delimiter injection allows attacker-chosen tool calls via quoted textSimilar attack · NVD/CVE Database