Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-09-24

HighPrimary

Decepticon ChatML Role Forgery Let Web Content Make an Autonomous Red-Team Agent Execute Attacker Commands

CVE-2026-61732 let ChatML tokens in crawled web content forge model roles and make a Decepticon red-team agent execute an attacker-chosen command.

DecepticonTool execution / MCPRole-boundary forgery in untrusted tool output leading to agent command executionDecepticon red-team deployments using self-hosted ChatML-compatible model backends

What happened

In controlled testing, Decepticon crawled attacker-controlled web content, composed preserved ChatML role tokens into model context, and executed a shell command selected by the attacker.

Why it matters

The demonstration created an attacker-chosen marker file inside the Decepticon Kali sandbox. The vulnerable path applied across the agent roster when used with model backends that preserved special-token IDs.

Missing authorization check

A policy decision independent of model context before command execution, bound to the target, command, environment, and authorized engagement.

Would PP block it?

Credential use, target-system mutation, data export, repository changes, and infrastructure operations could require receipts evaluated outside the compromised agent and model context. The forged role token would not itself satisfy that authorization.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-09-24

    The Decepticon security advisory publishes the controlled role-forgery reproduction as GHSA-g5f9-3xfg-p9mf and CVE-2026-61732.

  2. 2026-09-24

    Decepticon 1.1.17 is identified as the first patched release.

Technical breakdown

  • Reconnaissance agents collected attacker-controlled web content as raw tool output.
  • The model-call path did not escape ChatML special-token literals before context composition.
  • A compatible self-hosted tokenizer converted the literals into structural role boundaries.
  • The forged turn directed Decepticon's execution tool to run an attacker-chosen shell command in its Kali sandbox.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Command, credential, data-export, and target-mutation boundaries outside the Decepticon model context
Still needs
Model-token parsing, prompt-context integrity, commands allowed entirely inside the red-team sandbox, and activity on systems without an integrated gate remain outside coverage.
Receipt required for
Using protected credentials, changing target systems, exporting collected data, or executing commands outside the approved engagement scope

Permission Protocol cannot sanitize ChatML context or contain commands inside Decepticon's sandbox, but an external Runtime Gate can deny protected downstream actions that lack separately authenticated authority.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop