{"slug": "new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools", "title": "New “GhostJacking” Exploit Turns Trusted AI Agents Into Attack Tools", "summary": "Security firm Tenet presented research at DEF CON 34 showing that a new attack called GhostJacking exploits AI agents by hiding malicious instructions in data they analyze, such as firewall logs, allowing attackers to execute commands or leak credentials. In tests, the method succeeded in 9 out of 10 attempts against Claude Code under a configuration recommended by Cloudflare, and similar weaknesses were found in Datadog and other platforms.", "body_md": "A newly disclosed hacking technique called GhostJacking is exposing a serious blind spot in how organizations deploy [AI agents](https://www.kobaran.com/tag/AI-Agents) inside their security and cloud operations workflows. Rather than breaking into a network through a traditional software flaw, the attack manipulates the AI agents that companies already trust to monitor logs, triage alerts, and manage infrastructure.\n\nPresented at DEF CON 34 by security firm Tenet, the research shows how attackers can hide malicious instructions inside the everyday data that AI agents are asked to review, including firewall logs, monitoring alerts, and issue reports. When an AI agent reads that data as part of a routine investigation, it can be tricked into executing commands, altering infrastructure settings, or leaking cloud credentials, all while using access it was legitimately granted.\n\nThe findings matter because AI agents are increasingly plugged into high-privilege systems across the tech industry, from web application firewalls to cloud consoles. As more companies hand routine security and DevOps tasks to AI agents, GhostJacking illustrates how attackers are shifting their focus from breaking software to manipulating the judgment of the AI systems now sitting inside the security stack.\n\n## What Is GhostJacking\n\nGhostJacking is a form of indirect prompt injection aimed specifically at AI coding and operations agents connected to observability and security platforms. Instead of targeting a vulnerability in an application, the attack targets the trust relationship between an AI agent and the data sources it is asked to analyze.\n\n### How the Attack Chain Works\n\nThe exploit takes advantage of a simple workflow that security teams rely on every day. A malicious request gets blocked by a security tool, that blocked request is logged, and an analyst later asks an AI agent to review the log entry. If the blocked request contains attacker-crafted text, the AI agent may misread that text as a legitimate instruction rather than data to be summarized.\n\nTenet researchers demonstrated this directly against Cloudflare’s logging system. According to the firm, a request that Cloudflare’s web application firewall had already blocked was recorded in logs that contained attacker-controlled text. When an analyst asked an AI agent to investigate the blocked activity, the agent interpreted the injected content as operational guidance rather than a record of a rejected attack.\n\nIn one test scenario, this manipulation led the AI agent to modify DNS settings, a change that could redirect an organization’s web and email traffic to servers controlled by the attacker. Tenet reported that this method succeeded in 9 out of 10 attempts against Claude Code running under a configuration that Cloudflare itself recommends.\n\n### Why Standard Security Tools Miss It\n\nWhat makes GhostJacking difficult to catch is that nothing in the chain looks broken. The firewall blocks the malicious request exactly as designed. The AI agent uses valid, previously approved access tokens. The administrative tools it calls are ones it was authorized to use.\n\nSecurity teams typically watch for stolen credentials, unauthorized logins, or malware signatures. GhostJacking sidesteps all of that because the AI agent itself becomes the vehicle carrying out the attacker’s instructions, using permissions it already had. Endpoint detection tools, identity and access management controls, and web application firewalls are not built to flag an authorized agent behaving in an unauthorized way.\n\n## Attacks Confirmed Across Multiple Platforms\n\nThe Cloudflare scenario is only one piece of the research. Tenet documented similar weaknesses across other widely used observability and AI tooling platforms.\n\n### Datadog Diagnostic Events\n\nTenet found that publicly exposed client-side Datadog keys can let an attacker submit a crafted diagnostic event into a company’s monitoring system. When an engineer later asks an AI agent to look into the alert, the agent can process the attacker’s embedded content and carry out the command it contains. In Tenet’s test case, this resulted in unauthorized access to environment variables and cloud credentials, some of the most sensitive data a company can expose.\n\n### Agent-to-Agent Trust Abuse in Sentry’s Seer AI\n\nThe research also uncovered a more layered risk involving Sentry’s Seer AI system. An attacker-controlled error report can shape the conclusions Seer generates. A separate coding agent that later reads Seer’s AI-generated recommendation may act on it without ever reviewing the original malicious input.\n\nIn effect, one trusted AI system becomes an unwitting intermediary that lends legitimacy to an attacker’s instructions before they reach a second, more privileged agent.\n\n### A Patched Sandbox Escape in Claude Desktop\n\nTenet also disclosed a separate, now-fixed vulnerability in Anthropic’s Claude Desktop. The researchers reported that the flaw could have allowed data collected by an agent to bypass intended network restrictions and reach a server controlled by an attacker. Anthropic confirmed the issue and patched it before Tenet’s DEF CON presentation, and there is no indication the flaw was exploited outside of the research team’s own testing.\n\n## A Risk That Extends Beyond Any Single Vendor\n\nTenet was clear that GhostJacking is not a Cloudflare, Datadog, or Sentry problem specifically. It is a structural risk that can emerge anywhere an AI agent reads untrusted external data and then takes privileged action based on what it reads.\n\n| Attack Surface | How GhostJacking Could Exploit It |\n|---|---|\n| Monitoring and observability systems | Injected text hidden in logs or diagnostic events misread as instructions |\n| Ticketing and issue-tracking platforms | Malicious content in support tickets or bug reports triggers unintended agent actions |\n| Source control workflows | Poisoned commit messages or pull request content manipulate coding agents |\n| Cloud consoles | Agents with infrastructure access execute unauthorized configuration changes |\n| Build and deployment pipelines | Injected instructions during automated builds lead to compromised deployments |\n\nAny environment where an AI agent has both read access to external or user-generated content and write access to sensitive systems carries some version of this exposure.\n\n## What Security Teams Are Being Told To Do\n\nTenet’s recommendations center on limiting what AI agents can do automatically, rather than trying to filter every possible malicious input in advance. The firm advises organizations to deny default outbound network access for AI agents, require human approval before an agent executes commands or changes infrastructure, and separate read-only analysis tools from tools capable of making changes.\n\nTenet also recommends that companies treat every access token reachable by an AI agent as potentially exposed, given how easily an agent’s own permissions can be repurposed against it. To help teams act on this guidance, the company released Agent-Jackstop, an open-source hardening tool designed for Cursor and Claude Code.\n\n### Why This Story Is Still Developing\n\nBecause GhostJacking touches several major platforms used across the software industry, the response from affected vendors, along with any additional disclosures from Tenet or other researchers, is likely to continue unfolding in the days ahead. Organizations running AI agents with elevated cloud or infrastructure permissions are watching closely for further guidance on how to configure those systems safely.", "url": "https://wpnews.pro/news/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools", "canonical_source": "https://www.kobaran.com/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools/", "published_at": "2026-08-12 01:56:59+00:00", "updated_at": "2026-08-12 02:07:36.691937+00:00", "lang": "en", "topics": ["ai-safety", "ai-agents", "ai-policy", "artificial-intelligence"], "entities": ["Tenet", "DEF CON 34", "Cloudflare", "Claude Code", "Datadog"], "alternates": {"html": "https://wpnews.pro/news/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools", "markdown": "https://wpnews.pro/news/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools.md", "text": "https://wpnews.pro/news/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools.txt", "jsonld": "https://wpnews.pro/news/new-ghostjacking-exploit-turns-trusted-ai-agents-into-attack-tools.jsonld"}}