Ghostjacking: When AI Agents Become the Attack Vector

Your AI coding agent (Claude Code, Cursor, Codex, take your pick) is dutifully reviewing a security log. Routine stuff. Except buried in that log is an instruction planted by a clever attacker, and the agent reads it, treats it as legitimate and executes it. Using your permissions. Without a single security tool raising an eyebrow.

That is Ghostjacking, and obvously it works 9 out of 10 times.

Presented at DEF CON 34 on August 9, 2026 by researchers at Israeli security firm Tenet Security (Barak Sternberg, Nevo Poran, and Ron Bobrov), Ghostjacking is a class of indirect prompt injection that turns AI coding agents into unwitting accomplices. No malware needed, no sophisticated credential theft and no firewall breaches. Just an AI agent doing exactly what it was built to do: reading data, interpreting it and acting on it.

How the attack works

The core idea is almost embarrassingly simple. Attackers hide malicious instructions inside data sources that AI agents routinely read: security logs, monitoring alerts, error reports. When a developer asks their agent to investigate a blocked request or review an alert, the agent reads the attacker-planted content and follows the instructions as if they were legitimate.

The attacker is invisible, a ghost acting through the agent’s legitimate actions. Therefore the name.

Three platforms, three potential attack vectors

Tenet Security did not pick obscure targets but went after the platforms that run a significant part of enterprise IT infrastructure.

Cloudflare: DNS hijacking through firewall logs

Cloudflare processes about 20% of global internet traffic and 42% of Fortune 500 companies use it. The attack works like this:

An attacker sends a specially crafted HTTP request to a Cloudflare protected website. The WAF blocks it asit should and logs the full request content. Later a developer asks theAI agent to review the blocked requests. The agent reads the log, gets to the planted text and treats it like instructions. In the demonstration, the agent rewrote the domain’s DNS settings and redirected all web and email traffic to the attacker’s infrastructure.

Nine out of ten attempts were successful against Claude Code under Cloudflare default configuration.

Datadog: credential theft via fake alerts

The researchers found over 2,700 publicly exposed Datadog frontend API keys online. These are write-only keys so they let you send data to Datadog but not read anything. Sounds harmless? It is already enough for Ghostjacking…

An attacker uses one of these keys to push fake “urgent diagnostic” alerts into a company’s Datadog environment. When an AI agent checks the alerts it follows the included instructions and runs commands that expose environment variables, cloud credentials and API secrets. Datadog is used bi ca. 48% of Fortune 500 companies.

Sentry: one AI uses another

This is the vector that could keep architects up at night…

Sentry, which is used by about 4 million developers, exposes Data Source Names (DSNs) in frontend JavaScript by design because the client-side error reporting would not work otherwise. An attacker uses such a public DSN to submit a manipulated error report containing malicious instructions disguised as “Resolution” guidance in regular markdown format.

Here is where it gets ugly: Sentry’s own AI agent called “Seer” analyzes the crafted report and produces a recommendation incorporating the attacker’s payload. A separate coding agent (Claude Code, Cursor, whatever) retrieves that recommendation via MCP and implements the suggested “fix” without ever directly seeing the original malicious content.

One AI “launders” the instructions and another one executes them. The researchers call it a cross-agent trust chain, and in their earlier Agentjacking research (June 2026) they found more than 2,000 organisations with exploitable Sentry DSNs including a Fortune 100 company worth roughly $250 billion.

Why no security tools detect this

This is the part that should genuinely worry many security teams. Every single step in a Ghostjacking attack is a legitimate, regular, authorised operation where the agent is doing exactly what it was built and authorised to do: reading logs, analysing errors and then executing commands based on what it found.

The EDR sees nothing suspicious, the firewall sees no unauthorised traffic, and IAM controls see no privilege escalation because the agent already has the proper permissions. VPNs, network monitoring, SIEM, none of them flag a thing because from their perspective nothing special is happening.

“Each time the target AI refused, its refusal revealed the wording it would accept, until it ran the attack against itself.” This is another thing observed bi the researchers, so the defence mechanism becomes the training signal for the attack.

Which agents are vulnerable

Tenet Security tested Ghostjacking across Mac, Windows, WSL, containers, CI/CD pipelines and VS Code extensions:

  • Claude Code (Antropic) has a 90% success rate on the Cloudflare vector
  • Claude Desktop (Antropic): the researchers also found a separate sandbox escape vulnerability which Anthropic patched before the DEF CON presentation
  • Cursor (Anysphere)
  • OpenAI Codex CLI

The key takeaway is that this is not a bug in any single product but a systemic pattern. “Wherever an AI reads trusted outside data AND can act on it, the door opens,” as the researchers put it.

The dimensions of the problem

Cloudflare serves 42% of Fortune 500 companies and routes 20% of global internet traffic. Datadog serves 48% of the Fortune 500 and Sentry has 4 million acitive developer users. Based on 73 public artefacts found across 48 entities, Tenet Security estimates more than 15,000 organisations are currently exposed.

That is not a theoretical risk calculation but real, discoverable attack surfaces sitting in production environments right now.

What to do about it

Ghostjacking is not the kind of problem you fix with a patch because it is architectural. Tenet Security recommends five measures and none of them are optional if you are running AI agents in your workflow:

Block outbound network access by default. If the agent can not phone home to attacker-controlled servers then data exfiltration and malicious package downloads go nowhere.

Require human approval before command execution. It slows things down but it also breaks the automated kill chain. And make sure you actually read and understand these permission prompts!

Separate data consumption from instruction execution. What an agent reads should never automatically become something it runs. This is the fundamental architectural fix and the hardest one to implement: if it were not hard the exploits would not work…

Treat all public tokens as compromised. Use short-lived credentials everywhere. API keys in frontend code, CI/CD logs or public repos are not secrets no matter what we call them.

Audit all MCP connections. Understand what tools your agents can reach and how returned data could be manipulated by third parties. The Sentry vector shows exactly how MCP integrations create exploitable trust relationships.

Tenet Security has also released an agent-jackstop, an open-source tool with drop-in hardening configurations for Cursor and Claude Code.

The bigger picture

Ghostjacking is not an isolated finding but a symptom of something we have been building toward for a while: security architectures that assume authorised actions are always trustworthy. AI agents destroy that assumption because they can execute authorised actions based on untrusted inputs.

As long as an AI agent can read external data and act on it simultaneously this type of attack will exist. The question is not whether to adapt our security models but how fast we can do it…

Sources:

Autor: Andriu Isenring CISSP