A newly disclosed “Ghostjacking” is an AI-agent attack pattern that turns trusted operational data, including blocked web requests, monitoring alerts, and error reports, into a path for taking action within an enterprise.
The research, presented by Tenet Security at DEF CON 34, argues that the risk is architectural: an agent can read attacker-controlled content and exercise legitimate access to the same environment.
In the Cloudflare scenario, an attacker sends a malicious request that a web application firewall correctly blocks. The blocked payload is then preserved in security logs.
When an analyst asks an AI assistant to investigate those events, the agent may interpret embedded attacker text as instructions rather than untrusted evidence.
New GhostJacking Attacks Hijack AI Agents
If the assistant can change Cloudflare configuration, researchers said it may modify DNS records, direct a victim domain to attacker-controlled infrastructure, and falsely mark the investigation as resolved.
Tenet reported a nine-in-ten success rate against Claude Code in testing of Cloudflare’s recommended configuration. The consequence is not a firewall bypass in the conventional sense.
The control still blocks the request; the danger arises downstream, when a highly privileged agent consumes the resulting telemetry. DNS control can redirect web and email traffic, turning an operational workflow into a route to account takeover.
Defenders may see authorized API calls by an approved identity rather than malware, exploit traffic, or a clear policy violation. Tenet demonstrated related chains involving Datadog and Sentry.
In the Datadog case, a publicly exposed client-side key was used to inject a fraudulent “urgent diagnostic” alert. An agent asked to triage errors could be induced to execute commands, exposing environment variables and cloud credentials.
In the Sentry case, the company’s Seer AI could accept a maliciously framed remediation and pass that conclusion to another coding agent, creating an agent-to-agent trust hop.
The reported kill chain extends beyond initial prompt injection. It includes privilege escalation from developer workstations toward core cloud or domain administration, credential theft, and persistence through changes to agent configuration, memory or tool definitions.
Tenet also disclosed a Claude Desktop sandbox-escape issue that Anthropic confirmed and remediated before the presentation; technical exploitation details were withheld.
The findings underline a growing “confused deputy” problem for agentic systems. Agents are increasingly connected to observability, ticketing, source code, DNS, and cloud management tools.
Their permissions allow them to make consequential changes, yet language models do not inherently separate a log’s data from an instruction hidden within that data.
Traditional EDR, WAF, and IAM products are less likely to flag an action that is valid for the agent’s identity. Organizations should treat every externally influenced log, alert, issue, and report as untrusted input.
They should deny outbound agent network access by default, require human approval for commands and high-impact changes, isolate read-only investigation from write-capable operations, and issue short-lived, narrowly scoped credentials.
Teams should also audit agent tools, secrets, and memory-backed configurations for persistence paths. The core lesson of Ghostjacking is simple: an AI agent must never be allowed to convert untrusted context directly into privileged action.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
