# AI agent misreads hacker message, proposes DNS changes without approval > Source: > Published: 2026-08-26 16:20:00+00:00 Photo: Tima Miroshnichenko / Pexels # AI agent misreads hacker message, proposes DNS changes without approval Tenet Security's 'Ghostjacking' attack tricks AI agents into redirecting web traffic by hiding malicious instructions in error logs Security researchers have demonstrated a new class of attack that turns AI coding agents into unwitting accomplices. By planting malicious instructions inside ordinary error logs, attackers can trick AI agents into proposing DNS changes that redirect web traffic to domains controlled by hackers. The technique, dubbed “Ghostjacking,” was unveiled at DEF CON 34 by Tenet Security researchers. It boasts a roughly 90% success rate against Claude Code setups. ## How the attack works AI agents operating within platforms like Cloudflare, Datadog, and Sentry routinely ingest data from external tools: error logs, alerts, diagnostic outputs. Ghostjacking exploits the fact that these agents treat all of that input as trustworthy by default. An attacker poisons the logs with carefully crafted instructions disguised as legitimate diagnostic commands. When an AI agent like Cursor running Claude Code reads that poisoned data, it interprets the malicious text as a real action item. The agent then proposes or attempts to execute DNS changes that would reroute a company’s web traffic to an attacker-controlled domain. Tenet’s researchers demonstrated the attack across multiple platforms. Cloudflare was the headline target, but Datadog and Sentry were also turned into vectors for what the team described as operational sabotage. The researchers found thousands of exposed Datadog tokens and Sentry DSNs that could be exploited for log poisoning. ## Who’s at risk Tenet identified at least 48 organizations, including six Fortune 500 companies, running vulnerable MCP (Model Context Protocol) configurations that could be targeted by Ghostjacking. The researchers were careful to note that the AI agent in their demonstration could suggest DNS changes but could not unilaterally approve them. In a well-configured environment, a human would still need to sign off. ## The fix isn’t a patch Tenet Security released an open-source mitigation tool called “agent-jackstop” alongside their DEF CON presentation. The tool works by denying outbound access for AI agents and requiring explicit human approval for commands. It also classifies all tool output as untrusted by default. The researchers emphasized that Ghostjacking isn’t the kind of problem you solve with a software update. It’s a systemic design issue in how AI agents are architected and deployed. A separate but related issue involving a Claude Desktop sandbox escape was also noted by the researchers, though that vulnerability had been addressed before the DEF CON presentation. **Disclosure:** This article was edited by Editorial Team. For more information on how we create and review content, see our [Editorial Policy](https://cryptobriefing.com/editorial-policy/).