Ghostjacking attack uses poisoned logs to compromise AI agents

Tenet Security unveiled the Ghostjacking attack at DEFCON 34 on August 9, demonstrating a 90% success rate against Claude Code under Cloudflare's default settings by poisoning logs from platforms like Cloudflare, Datadog, and Sentry. The attack exploits AI agents' tendency to treat all input as instructions, potentially exposing over 15,000 organizations via vulnerable Cloudflare configurations and over 2,700 publicly exposed Datadog API keys. Tenet warns that compromised agents can cascade across platforms, granting attackers developer-level access without authentication.

Via reco.ai Ghostjacking attack uses poisoned logs to compromise AI agents Tenet Security demonstrates how attackers can hijack AI agents through trusted security platforms with a 90% success rate Security researchers have found a way to turn the tools companies trust most against them. The attack, called Ghostjacking, manipulates AI agents into executing harmful actions by poisoning the very logs and alerts those agents are designed to monitor. Tenet Security unveiled the technique at DEFCON 34 on August 9, demonstrating how attackers can inject malicious instructions into data streams from platforms like Cloudflare, Datadog, and Sentry. The result: AI agents that obediently make DNS changes, execute code, and steal credentials, all while thinking they’re doing their job. How Ghostjacking works Tenet’s research showed a 90% success rate against Claude Code when operating under Cloudflare’s default configuration settings. Cloudflare handles roughly 20% of internet traffic, and approximately 42% of Fortune 500 companies rely on it. Datadog, also affected, is used by about 48% of Fortune 500 companies. The attack builds on Tenet’s earlier research into what they called Agentjacking, but extends the concept dramatically. Where the previous work demonstrated the theoretical risk, Ghostjacking shows a complete agentic kill chain: initial access, privilege escalation, data exfiltration, and persistence. All without tripping EDR, WAF, or IAM security tools. The scale of exposure Tenet estimates that more than 15,000 organizations could be exposed through vulnerable Cloudflare configurations alone. Researchers also found over 2,700 Datadog API keys exposed publicly, each one a potential entry point for launching a Ghostjacking attack. What makes this particularly dangerous is the chain reaction potential. A compromised agent on one platform can leap to agents on other platforms, creating cascading failures across an organization’s infrastructure. One poisoned log entry in Cloudflare could compromise an agent that then interacts with Datadog, which in turn affects agents monitoring Sentry alerts. Why AI agents are uniquely vulnerable The fundamental problem isn’t a bug in any specific platform. It’s an architectural flaw in how AI agents process information. Large language models treat all input as potential instruction, a feature that makes them useful but also makes them exploitable. The agents affected aren’t experimental toys. Claude Code, one of the primary targets in Tenet’s research, is Anthropic’s coding agent designed for professional software development. When it operates with elevated permissions in a cloud environment, a successful Ghostjacking attack means an adversary effectively gains developer-level access without ever authenticating. What this means for organizations using AI agents The immediate implication is that companies need to rethink how much autonomous authority they grant AI agents, particularly when those agents consume data from external or semi-external sources. The principle of least privilege, already a cornerstone of security best practices, becomes even more critical when the entity receiving permissions can be tricked by its own inputs. Cloudflare, Datadog, and Sentry will need to address how their platforms can be hardened against log injection. But the deeper issue transcends any single vendor. As long as AI agents treat trusted data sources as implicitly safe instruction channels, Ghostjacking and its variants will remain a viable attack strategy. Disclosure: This article was edited by Editorial Team. For more information on how we create and review content, see our Editorial Policy https://cryptobriefing.com/editorial-policy/ .