Decepticon indirect prompt injection RCE (CVE-2026-61732) [PoC]

Exploitation confirmed - public proof-of-concept - CVE-2026-61732 is a critical indirect prompt-injection flaw in Decepticon versions prior to 1.1.17 that lets attacker-controlled web content forge an operator turn and execute arbitrary commands inside the agent’s Kali Linux sandbox. Update to 1.1.17 now; there is no configuration workaround for BYOK deployments.

Overview

Decepticon is an autonomous hacking agent built for red teams. It crawls target services during reconnaissance and feeds the results back to a large language model as messages. Before version 1.1.17, that step copies raw web content into the LLM message stream without stripping ChatML special-token literals such as role-boundary markers.

Under the BYOK (Bring Your Own Key) model, operators point Decepticon at any OpenAI-compatible endpoint using their own credentials. Most self-hosted and open-source inference servers - vLLM, SGLang, Ollama, LM Studio, text-generation-webui, and similar - do not filter special-token strings from user content in their default configuration. Those literals are parsed into real structural tokens, so the model sees a new role boundary rather than plain text. An attacker who controls a page the agent crawls during a red-team engagement can plant a string that forges a fresh operator turn. The model treats that forged turn as authoritative, ignores the agent’s guardrails, and runs the attacker’s commands.

Impact

The forged operator turn breaks out of the agent’s safety layer and lands directly on the sandbox. All four CVSS base metrics are at their most severe: network attack vector, low complexity, no privileges, and no user interaction (CVSS 10.0). An attacker only needs to control content on a host the engagement targets, which is common in red-team reconnaissance against external services.

Because Decepticon runs on Kali Linux with a full offensive toolset, command execution in the sandbox is high value. An attacker can pivot to other hosts in scope, exfiltrate engagement data gathered by the agent, or corrupt crawl results to mislead the operator. No proof-of-concept code is required for exploitation - a crafted web page is enough.

Remediation and Mitigation

• Upgrade Decepticon to 1.1.17 or later. The fix neutralizes ChatML special-token literals before crawl results enter the LLM message stream, so planted strings stay inert.
• Operators who cannot patch immediately should restrict crawling to trusted internal targets and avoid untrusted external hosts during reconnaissance.
• If you run a self-hosted inference server, enable special-token filtering where the server supports it. Treat this as defense in depth, not a substitute for the 1.1.17 upgrade, since filtering behavior varies by provider.
• Audit recent engagements for anomalous agent actions, unexpected outbound connections from the sandbox, and crawl results that differ from what the target served.

CISA has not added this CVE to the KEV catalog, and there is no confirmed active exploitation. Treat it as a serious latent risk for any BYOK red-team deployment that crawls attacker-influenced content.

Security Insight

This is the classic indirect prompt-injection pattern that the security industry has warned about for years, now landing on an offensive tool rather than a chatbot. It mirrors the same class of trust-boundary failure seen in recent Linux kernel flaws added to KEV: untrusted input crosses into a privileged execution context because the sanitization step was skipped. Red-team tooling that consumes arbitrary web content deserves the same input-validation rigor as any other network-facing service.

Related: CISA adds Linux kernel CVE-2025-39682 to KEV catalog, Weekly Threat Roundup: Apache & cPanel Zero-Days, and Teamsters Local 773 hit by INC Ransom.

Further Reading

• CISA adds Linux kernel CVE-2025-39682 to KEV catalog
• CISA Adds Actively Exploited Linux Root Bug CVE-2026-31
• Weekly Threat Roundup: Apache & cPanel Zero-Days (Apr 27 - May 3)
• All Critical Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs