Summary
Decepticon can allow prompt injection when web crawl results containing unneutralized ChatML special-token literals are inserted into LLM messages. An attacker who can influence content on a crawled page may forge an apparent operator message, bypass agent guardrails, and cause arbitrary commands to execute in the Kali Linux sandbox.
Affected context
The vulnerability occurs in Decepticon deployments that:
- Use the autonomous web reconnaissance and crawling workflow
- Insert crawl results into prompts sent to an LLM
- Use a BYOK or self-hosted OpenAI-compatible model endpoint
- Rely on a provider configuration that interprets ChatML or other special-token literals as message boundaries
Risk is higher when crawled content can be influenced by external parties and the agent has broad permissions inside its execution sandbox.
Exploit preconditions
- Attack surface: Web content collected by the reconnaissance crawler
- Required access: The ability to place or modify content that the target crawler will retrieve
- Trigger point: Processing and inclusion of crawl results in an LLM conversation
- Required deployment condition: The configured model endpoint must interpret special-token literals as structural role boundaries
- Why exploitation is possible: Untrusted page content is treated as trusted conversational structure, allowing attacker-controlled text to influence the model's authority hierarchy and tool-use decisions
Why this happens
The underlying issue is improper neutralization of special-token literals in untrusted content before that content is converted into LLM messages. When a model provider recognizes those literals as structural conversation markers, text originating from a web page can alter the apparent speaker or role of subsequent content.
This maps to CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component. The insecure pattern is allowing externally controlled data to cross into a downstream language-model protocol without preserving its status as inert data or enforcing an independent message structure.
Potential impact
- An attacker may bypass agent guardrails
- The agent could interpret attacker-controlled instructions as authoritative
- Arbitrary commands may execute inside the Kali Linux sandbox
- Reconnaissance results, files, or collected data could be altered or exposed
- The sandbox may be used for unauthorized network activity or lateral movement
- Repeated exploitation could undermine the integrity of red-team workflows
General mitigation guidance
Mitigation generally focuses on preserving the boundary between untrusted web data and trusted agent instructions.
Common defensive patterns include:
- Treating crawl results as explicit data fields rather than concatenated conversational instructions
- Neutralizing or encoding protocol-specific special-token literals before model submission
- Constructing role and message boundaries programmatically instead of accepting them from content
- Applying strict allowlists and schema validation to model-generated tool calls
- Requiring independent authorization for high-impact commands
- Running the agent with least privilege, restricted filesystem access, and limited network permissions
- Using model endpoints configured to treat user-provided special-token text as ordinary content
- Adding human or policy-based approval gates for actions that exceed reconnaissance needs
These controls reduce exposure even when an attacker can influence a crawled page or the model produces unsafe instructions.
How teams detect issues like this
Detection can combine source analysis, runtime controls, and agent-behavior monitoring:
- Search code and templates for direct interpolation of crawl results into role-sensitive prompts
- Flag unescaped ChatML, instruction delimiters, and provider-specific special-token patterns in untrusted text
- Review message construction for data fields that can influence system, operator, or tool roles
- Use static analysis and automated review rules to identify prompt assembly from external content
- Log the origin and trust classification of every message segment sent to the model
- Monitor for unexpected role transitions, tool calls, or commands not supported by the active task
- Enforce policy checks that reject commands outside approved binaries, paths, and network destinations
- Test with adversarial web content in isolated environments to verify that crawled text remains non-authoritative
