Decepticon, an autonomous hacking agent for red teams, is vulnerable when earlier versions wrap web crawl results into large language model messages without removing special-token literals specific to ChatML. These literals are interpreted as role‑boundary tokens, allowing attacker‑inserted strings on a target web page to forge a new operator turn that the model treats as authoritative. This bypasses Decepticon’s guardrails and permits the attacker to execute arbitrary commands inside the Kali Linux sandbox, resulting in full compromise of the sandbox environment.

The affected products are BitterSecurity’s Decepticon, Decepticon‑core and Decepticon‑sdk. Vulnerable releases are all versions prior to v1.1.17; the fix is included in v1.1.17 and later.

The CVSS score of 10 signals a critical vulnerability. Although the EPSS score is not available and the issue is not listed in CISA’s KEV catalog, the likely attack vector requires that the user has deployed Decepticon with a Bring‑Your‑Own‑Key LLM endpoint that does not strip ChatML special‑token literals. Based on the description, an attacker can inject malicious content into a target web page, which is then re‑interpreted by the LLM and executed in the sandbox with full privileges. With no known mitigated status and a critical severity, the risk is high for any environment running the vulnerable Decepticon components.