A web page could hijack an open-source hacking agent into running its commands

What happened

Decepticon, an open-source autonomous hacking agent for red teams, wrapped the web pages it crawled during reconnaissance into the model's conversation without neutralising ChatML special-token literals such as <|im_start|>. Most self-hosted inference servers, including vLLM, SGLang and Ollama, parse those literals in user content into real role-boundary tokens by default, so a string planted on a target's web page forges a new operator turn the model treats as authoritative. The chain bypasses the agent's guardrails and reaches arbitrary command execution inside its Kali Linux sandbox, scored CVSS 3.1 10.0.

Published on 24 September 2026 and fixed in 1.1.17. The exposed setup is the bring-your-own-key deployment pointed at a self-hosted OpenAI-compatible endpoint, and the page doing the hijacking is the very target the agent was sent to test.