{
 "id": "AIR-2026-0197",
 "slug": "cve-2026-61732-decepticon-autonomous-hacking-agent-chatml-in",
 "title": "CVE-2026-61732: Decepticon autonomous hacking agent ChatML injection vulnerability",
 "summary": "An input sanitization flaw in Decepticon before version 1.1.17 fails to neutralize ChatML special tokens in web crawl results. Under BYOK deployment models, this allows malicious web content to inject instructions into LLM interactions.",
 "type": "attack_on_ai",
 "categories": [
  "prompt_injection",
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Decepticon"
 ],
 "incident_date": "2026-09-24",
 "incident_date_precision": "day",
 "first_reported": "2026-09-24",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-61732",
   "publisher": "NVD",
   "title": "CVE-2026-61732: Decepticon is an autonomous hacking agent for red teams.",
   "published_at": "2026-09-24"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-61732",
  "chatml",
  "prompt-injection"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}